CVE-2025-59103
CriticalSummary
Access Manager 92xx in hardware revision K7 runs Linux instead of Windows CE. An SSH service on port 22 exposes two users with hardcoded weak passwords that are easy to guess. Passwords are randomized only if the device date is set before 2022, so under certain conditions (e.g., unset clock) they remain unchanged.
Risk Assessment
Unauthorized SSH access could allow an attacker to fully control the access control system, compromising physical security.
Recommendation
Change default passwords to strong unique values and ensure the device clock is correctly set to enforce password randomization.
Other vulnerabilities in Access Manager 92xx
See all- CVE-2025-59101High
The vulnerability in Access Manager relies on per-request verification of the originating IP address instead of session tokens or cookies. Once an authentication request from a given IP succeeds, that IP is treated as authenticated with no other session data stored. An attacker can spoof the IP of a logged-in user to gain access to the Access Manager web interface.
- CVE-2025-59098High
The Access Manager offers a trace functionality for debugging, implemented as a simple TCP socket. Debug data is permanently broadcasted on this socket without any authentication or encryption. The verbosity level can be set via HTTP(S) endpoint with the service interface password or via SOAP interface with a guessable device identifier.
- CVE-2025-59108Critical
By default, the password for the Access Manager's web interface is set to 'admin'. In the tested version, changing the password was not enforced.
- CVE-2026-27768Medium
SQL Injection vulnerability in the Access Manager role. An attacker can inject malicious SQL queries.
Original NVD description (English source)
The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it was noticed that there are two users with hardcoded and weak passwords that can be used to access the devices via SSH. The passwords can be also guessed very easily. The password of at least one user is set to a random value after the first deployment, with the restriction that the password is only randomized if the configured date is prior to 2022. Therefore, under certain circumstances, the passwords are not randomized. For example, if the clock is never set on the device, the battery of the clock module has been changed, the Access Manager has been factory reset and has not received a time yet.