CVSS 3.1
8.8 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HCVE-2025-59106
High (8.8) in dormakabagroup. EPSS 0.8% chance of exploitation in the next 30 days.
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.
Severity
- EPSS
- 0.8% chance of exploitation in the next 30 days; higher than 56% of CVEs (scores of 2026-10-31)
- CWE
- CWE-272
- Published
- Modified
- Record from
- the NVD, synced
Affected
- dormakabagroup:dormakaba_access_manager_9200-k5_firmware
- dormakabagroup:dormakaba_access_manager_9200-k7_firmware
- dormakabagroup:dormakaba_access_manager_9230-k5_firmware
- dormakabagroup:dormakaba_access_manager_9230-k7_firmware
- dormakabagroup:dormakaba_access_manager_9290-k5_firmware
- dormakabagroup:dormakaba_access_manager_9290-k7_firmware