CVE-2025-59107: Static Firmware Encryption Password in dormakaba access manager

Severity: high (CVSS 8.5 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-26 · updated 2026-06-17
Weakness: CWE-798

Description

Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.

Affected products

dormakaba Access Manager 92xx-k5: all versions

References

https://r.sec-consult.com/dkaccess
https://r.sec-consult.com/dormakaba
https://www.dormakabagroup.com/en/security-advisories

Get alerted when CVE-2025-59107 or the next vulnerability affects your stack