CVE-2024-29916: Medium severity dormakaba Saflok vulnerability
The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the key derivation function relies only on a UID. This affects, for example, Saflok MT, and the Confidant, Quantum, RT, and Saffire series.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29916?
CVE-2024-29916 is considered a high-severity vulnerability due to its potential for unauthorized access to secure areas.
How do I fix CVE-2024-29916?
To fix CVE-2024-29916, update your dormakaba Saflok system to the November 2023 software version or later.
What products are affected by CVE-2024-29916?
CVE-2024-29916 affects the dormakaba Saflok system, including versions prior to November 2023, along with related products like Saflok MT, Confidant, Quantum, RT, and Saffire.
What causes CVE-2024-29916?
CVE-2024-29916 is caused by the ability of an attacker to use forged keycards to unlock doors if they have obtained at least one active or expired keycard for the property.
What should I do if I cannot update my system for CVE-2024-29916?
If you cannot update your system for CVE-2024-29916, implement strict access controls and review keycard issuance policies to mitigate the risk.