CVE-2025-59090: Unauthenticated SOAP API in dormakaba Kaba exos 9300

Published Jan 26, 2026

Updated

On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not require any authentication prior to sending requests. Therefore, network access to the exos server allows e.g. the creation of arbitrary access log events as well as querying the 2FA PINs associated with the enrolled chip cards.

Affected Software

1 affected component

dormakaba Kaba exos 9300

Remediation

Information

It is highly recommended to encrypt the communication to the Access Manager 92xx K5 via IPSec. The Configuration is described in the device reference manual. It is also recommended to secure the used communication port from external access. To encrypt the communication to the Access Manager 92xx K7, an mTLS connection can be set up. For new installations in combination with exos 4.4.x, HTTPS with self-signed certificates is activated by default. In existing installations, this must be configured manually. HTTPS with self-signed certificates can be configured at any time. The configuration is described in the device reference manual. It is also recommended to secure or close the used communication port from external access.

Event History

Jan 26, 2026

CVE Published

via MITRE·10:03 AM

Data Sourced

via MITRE·10:03 AM

RemedyDescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2025-59090?

CVE-2025-59090 is considered to have a high severity due to its potential for unauthorized modifications through an unauthenticated SOAP API.

How do I fix CVE-2025-59090?

To fix CVE-2025-59090, limit network access to the exos 9300 server and implement authentication for the SOAP API.

What vulnerabilities does CVE-2025-59090 expose?

CVE-2025-59090 exposes the ability to create arbitrary access log events and potentially other unauthorized actions on the exos 9300 server.

Is CVE-2025-59090 remote exploit?

Yes, CVE-2025-59090 can be exploited remotely due to the unauthenticated nature of the SOAP API accessible over the network.

What systems are affected by CVE-2025-59090?

CVE-2025-59090 affects the dormakaba Kaba exos 9300 systems that expose the SOAP API on port 8002.