CVE-2025-59098
HighSummary
The Access Manager offers a trace functionality for debugging, implemented as a simple TCP socket. Debug data is permanently broadcasted on this socket without any authentication or encryption. The verbosity level can be set via HTTP(S) endpoint with the service interface password or via SOAP interface with a guessable device identifier.
Risk Assessment
An attacker with network access can capture sensitive data such as Card IDs and all button presses on registration units, allowing theft of all entered PINs. This is a serious breach of authentication data confidentiality.
Recommendation
Immediately restrict network access to the TCP socket used by the trace function, e.g., via firewalls and network segmentation. Also enable authentication and encryption for this function and change default device identifiers.
Other vulnerabilities in Access Manager
See all- CVE-2025-59101High
The vulnerability in Access Manager relies on per-request verification of the originating IP address instead of session tokens or cookies. Once an authentication request from a given IP succeeds, that IP is treated as authenticated with no other session data stored. An attacker can spoof the IP of a logged-in user to gain access to the Access Manager web interface.
- CVE-2025-59108Critical
By default, the password for the Access Manager's web interface is set to 'admin'. In the tested version, changing the password was not enforced.
- CVE-2025-59103Critical
Access Manager 92xx in hardware revision K7 runs Linux instead of Windows CE. An SSH service on port 22 exposes two users with hardcoded weak passwords that are easy to guess. Passwords are randomized only if the device date is set before 2022, so under certain conditions (e.g., unset clock) they remain unchanged.
- CVE-2026-27768Medium
SQL Injection vulnerability in the Access Manager role. An attacker can inject malicious SQL queries.
Original NVD description (English source)
The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the socket and receive debug information. The data is permanently broadcasted on the TCP socket. The socket can be accessed without any authentication or encryption. The transmitted data is based on the set verbosity level. The verbosity level can be set using the http(s) endpoint with the service interface password or with the guessable identifier of the device via the SOAP interface. The transmitted data contains sensitive data like the Card ID as well as all button presses on Registration units. This allows an attacker with network level access to retrieve all entered PINs on a registration unit.