CVE-2025-59107

8.5 highEPSS 0.2%

High (8.5). EPSS 0.2% chance of exploitation in the next 30 days.

Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

EPSS: 0.2% chance of exploitation in the next 30 days; higher than 7% of CVEs (scores of 2026-10-31)
CWE: CWE-798
Published: 2026-01-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://r.sec-consult.com/dkaccess
https://r.sec-consult.com/dormakaba
https://www.dormakabagroup.com/en/security-advisories

Check your stack JSON