PT-2026-4741 · Kaba · Kaba Exos 9300
CVE-2025-59091
·
Publicado
2026-01-26
·
Atualizado
2026-01-26
CVSS v4.0
9.3
Crítica
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Kaba exos 9300 (affected versions not specified)
Description
The Kaba exos 9300 datapoint server, running on ports 1004 and 1005, is susceptible to unauthorized access due to the presence of hardcoded credentials. This server relays status information from and to Access Managers, including data related to door status and alerts. Authentication is required to send and receive information, and the application contains four hardcoded user credentials that allow login and the ability to send commands, potentially including opening doors. The datapoint server is used for relaying status information from and to the Access Managers.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Using Hardcoded Credentials
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Kaba Exos 9300