CVE-2025-59100: Unauthenticated Access to the SQLite Database in dormakaba access manager
The web interface offers a functionality to export the internal SQLite database. After executing the database export, an automatic download is started and the device reboots. After rebooting, the exported database is deleted and cannot be accessed anymore. However, it was noticed that sometimes the device does not reboot and therefore the exported database is not deleted, or the device reboots and the export is not deleted for unknown reasons. The path where the database export is located can be accessed without prior authentication. This leads to the fact that an attacker might be able to get access to the exported database without prior authentication. The database includes sensitive data like passwords, card pins, encrypted Mifare sitekeys and much more.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-59100?
CVE-2025-59100 is considered a high severity vulnerability due to the potential for unauthorized access to sensitive data.
How do I fix CVE-2025-59100?
To mitigate CVE-2025-59100, ensure that proper access controls are in place and limit exposure of the database export functionality.
What software is affected by CVE-2025-59100?
The affected software for CVE-2025-59100 is the dormakaba access manager.
What kind of data is exposed in CVE-2025-59100?
CVE-2025-59100 exposes the internal SQLite database, which may contain sensitive data.
Can CVE-2025-59100 be exploited remotely?
Yes, CVE-2025-59100 can be exploited remotely through the web interface without any authentication.