Back to Database
Status published
Medium
CVE-2025-59096
Weak Default Password in dormakaba Kaba exos 9300
Vulnerability Description
The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as well as documented in the locally stored user documentation.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59096
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Clemens Stockenreitner, SEC Consult Vulnerability Lab
- Werner Schober, SEC Consult Vulnerability Lab
References
More from dormakaba
View All →CVE-2025-59109
UART Leaking Sensitive Data in dormakaba registration unit 9002
Medium
5.1
CVE-2025-59108
Weak Default Passwords in dormakaba access manager
Critical
9.2
CVE-2025-59107
Static Firmware Encryption Password in dormakaba access manager
High
8.5
CVE-2025-59106
Web Server Running with Root Privileges in dormakaba access manager
Unknown
0
CVE-2025-59105
Unencrypted Flash Storage in dormakaba access manager
High
7
Affected Vendor
dormakaba
View all reports →Affected Software
Kaba exos 9300
Vulnerable Versions:
All versions, manual mitigation needed!
Timeline
Official Publish:
January 26th, 2026
Last Modified:
January 26th, 2026
Added to House:
July 22nd, 2026