What’s Vulnerable › Vulnerabilities
CVE-2024-29916
- Severity: medium (CVSS 5.6 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2024-03-21 · updated 2026-06-17
- Weakness: CWE-407
Description
The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the key derivation function relies only on a UID. This affects, for example, Saflok MT, and the Confidant, Quantum, RT, and Saffire series.
Affected products
- dormakaba Confidant Firmware: all versions
- dormakaba Quantum Firmware: all versions
- dormakaba Saffire Firmware: all versions
- dormakaba Saflok Mt Firmware: all versions
- dormakaba Saflok Rt Firmware: all versions
References
- https://news.ycombinator.com/item?id=39779291
- https://unsaflok.com
- https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/
- https://www.youtube.com/watch?v=4cx0RUV7i0s
- https://news.ycombinator.com/item?id=39779291
- https://unsaflok.com
- https://www.wired.com/story/saflok-hotel-lock-unsaflok-hack-technique/
Get alerted when CVE-2024-29916 or the next vulnerability affects your stack