CVE Feed

    Dashboard / CVE / CVE-2025-59093

    CVE-2025-59093

    Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker to derive the database password and get authenticated access to the central exos 9300 database as the user Exos9300Common. The user has the roles ExosDialog and ExosDialogDotNet assigned, which are able to read most tables of the database as well as update and insert into many tables.

    Published:Jan 26, 2026
    Last Modified:Apr 15, 2026
    EPS:Jan 26, 2026
    EPSS Score:0.00019
    CVSS Score:8.5

    Affected Products

    Vendor
    Dormakaba
    Product
    Kaba Exos 9300

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2025-59096 (CVSS 4.6) — The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administr…
    CVE-2025-59095 (CVSS 6.8) — The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable ex…
    CVE-2025-59094 (CVSS 8.4) — A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management applica…
    CVE-2025-59092 (CVSS 8.7) — An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterfa…
    CVE-2025-59091 (CVSS 9.3) — Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint s…
    CVE-2025-59090 (CVSS 9.3) — On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication pr…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High