CVE Feed

    Dashboard / CVE / CVE-2025-59096

    CVE-2025-59096

    The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as well as documented in the locally stored user documentation.

    Published:Jan 26, 2026
    Last Modified:Apr 15, 2026
    EPS:Jan 26, 2026
    EPSS Score:0.00016
    CVSS Score:4.6

    Affected Products

    Vendor
    Dormakaba
    Product
    Kaba Exos 9300

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-798 Use of Hard-coded Credentials

    Related CVEs

    CVE-2025-59095 (CVSS 6.8) — The program libraries (DLL) and binaries used by exos 9300 contain multiple hard-coded secrets. One notable ex…
    CVE-2025-59094 (CVSS 8.4) — A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management applica…
    CVE-2025-59093 (CVSS 8.5) — Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server…
    CVE-2025-59092 (CVSS 8.7) — An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterfa…
    CVE-2025-59091 (CVSS 9.3) — Multiple hardcoded credentials have been identified, which are allowed to sign-in to the exos 9300 datapoint s…
    CVE-2025-59090 (CVSS 9.3) — On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication pr…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High