Vulnerability · Published Jan 26, 2026 · Assigned by SEC-VLab

CVE-2025-59107Static Firmware Encryption Password in dormakaba access manager

High 8.5

In plain English

A high-severity hard-coded credentials in Access Manager 92xx-k5 from dormakaba. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 4.0)8.5High

Exploit odds (30 days)0.2%top 92.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.

Affected products (as reported)

Vendor	Product	Versions
dormakaba	Access Manager 92xx-k5	All versions

Weakness: CWE-798 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://r.sec-consult.com/dormakaba technical-description
https://r.sec-consult.com/dkaccess third-party-advisory
https://www.dormakabagroup.com/en/security-advisories vendor-advisory