Vulnerability · Published Jan 26, 2026 · Assigned by SEC-VLab

CVE-2025-59092Unauthenticated RPC Service in dormakaba Kaba exos 9300

High 8.7

In plain English

A high-severity hard-coded credentials in Kaba exos 9300 from dormakaba. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.9%top 41.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An RPC service, which is part of exos 9300, is reachable on port 4000, run by the process FSMobilePhoneInterface.exe. This service is used for interprocess communication between services and the Kaba exos 9300 GUI, containing status information about the Access Managers. Interacting with the service does not require any authentication. Therefore, it is possible to send arbitrary status information about door contacts etc. without prior authentication.

Affected products (as reported)

Vendor	Product	Versions
dormakaba	Kaba exos 9300	< 4.4.0

Weakness: CWE-798 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://r.sec-consult.com/dormakaba technical-description
https://r.sec-consult.com/dkexos third-party-advisory
https://www.dormakabagroup.com/en/security-advisories vendor-advisory