VULNARCHIVE

GCVE-1988-2026-0190

SEC Consult SA-20260126-0 :: Multiple Critical Vulnerabilities in dormakaba Kaba exos 9300

Description (en)

SEC Consult Vulnerability Lab Security Advisory < 20260126-0 >
=======================================================================
              title: Multiple Critical Vulnerabilities
            product: dormakaba Kaba exos 9300
 vulnerable version: < 4.4.1
      fixed version: 4.4.1
         CVE number: CVE-2025-59090, CVE-2025-59091, CVE-2025-59092
                     CVE-2025-59093, CVE-2025-59094, CVE-2025-59095
                     CVE-2025-59096
             impact: critical
           homepage:https://www.dormakaba.com/
              found: 2024-03-18
                 by: Clemens Stockenreitner (Office Vienna)
                     Werner Schober (Office Vienna)
                     SEC Consult Vulnerability Lab

                     An integrated part of SEC Consult, an Atos business
                     Europe | Asia

                     https://www.sec-consult.com

=======================================================================

Vendor description:
-------------------
"The Kaba exos 9300 basic system is the cornerstone of your access
management solution. Use it to resolves all your basic employees,
system, user and peripheral management tasks and initiate targeted
security measures as required. [...] "

Source:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000


Business recommendation:
------------------------
The vendor provides multiple patches which should be installed immediately.
More details can be found at the following locations:
- Solution at the end of this advisory
- SEC Consult blog post:https://r.sec-consult.com/dormakaba
- Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories
- Your dormakaba partner


Tested Architecture Overview
-----------------------------------
The tested system is the enterprise grade physical access system from
dormakaba. The tested system consists of the following components:

------------------------------
dormakaba exos 9300
------------------------------
Exos 9300 is a piece of software based on C# running on a central Windows server with
an MSSQL, or Oracle database as central storage.
Exos consists of multiple modules (e.g. basis, employee management, key depot, access,
visitor management, 3rd party management). Exos is used to centrally manage users,
keys, cards as well as the configuration of the access manager. Devices in the
exos environment are addressed using a special addressing scheme. The address scheme
described in the following table is going to be important.

┌────────────────────┬───────────────────────────┬───────────────┬───────────────────────────────────────────┬───────────────────────────┬───────────────────┐
│         I          │            01             │      00       │                    01                     │          
  00             │        00         │
├────────────────────┼───────────────────────────┼───────────────┼───────────────────────────────────────────┼───────────────────────────┼───────────────────┤
│ Port Type          │ Communication Hub Address │ Port Address  │ Access Hub Address                        │ 00 = 
Door Manager         │ Datapoint Address │
│ I = Access Manager │ Values: 01-99             │ Values: 00-99 │ Values: 00-99                             │ 01 = 
Access Point         │ Values: 00-20     │
│ B = Serial         │                           │               │ Fixed to 01 for Access Hubs with Ethernet │ 02 = 
Turnstile            │                   │
│ C = Modem          │                           │               │                                           │ 03 = IO 
Controller        │                   │
│ E = Ethernet       │                           │               │                                           │ Fixed to 
00 in most cases │                   │
│ R = remote         │                           │               │                                           │          
                 │                   │
└────────────────────┴───────────────────────────┴───────────────┴───────────────────────────────────────────┴───────────────────────────┴───────────────────┘

------------------------------
dormakaba Access Manager
------------------------------
The access manager is a component that is configured via exos. The configuration
between exos and access manager is exchanged via a SOAP interface. Per default
the data exchange is unencrypted. Encryption is only available starting with
access manager hardware release K7.

The access manager is a custom piece of hardware with multiple inputs and outputs.
The device offers the following interfaces:
- Digital Inputs
- 3x DC Output Relays
- 2x RS-232
- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)
- 1x RJ45
- 1x Micro USB
- 2x Coax (Used to connect registration units e.g. 9001, 9002)

The tested hardware was an access manager 9200-k5 running Windows CE embedded,
and an access manager 9200-k7 running Linux.

------------------------------
dormakaba Registration Unit
------------------------------
dormakaba registration units can be either a Legic/Mifare card reader,
or a PIN pad used to enter a PIN to deactivate alarming systems, or as
an additional authentication.

------------------------------
Electric lock
------------------------------
The lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock
is simply controlled via a relay contact connected to the access manager. As
soon as a user successfully authenticates with a registration unit,
the relay connected to the lock is switched and the door opens.

The system is depicted in the following diagram.

          ┌─────────┐
          │         │
          │exos 9300│              ┌──────────┐  ┌──────────┐
          │         │              │ Reg Unit │  │ Pin Pad  │
          └────┬────┘              │   ┌──┐   │  │  x x x   │
               │                   │   │┼┼│   │  │  x x x   │
Ethernet──────►│                   │   └──┘   │  │  x x x   │
               │                   │   9001   │  │   9002   │
          ┌────┴────┐              └─────┬────┘  └─────┬────┘
          │ Access  │                    │             │
          │ Manager ├────────────────────┴─────────────┘
          │  9200   │        ▲
          └────┬────┘        │
               │           Coax
               │
  DC Relay───► │
               │
            ┌──┴──┐
            │     │
            │     │
            │     │
            │    ─┤◄──────Electric Lock
            │     │
            │     │
            └─────┘


Vulnerability overview/description:
-----------------------------------
1) Unauthenticated SOAP API (CVE-2025-59090)
On the exos 9300 server, a SOAP API is reachable on port 8002. This API does not
require any authentication prior to sending requests. Therefore, network access
to the exos server allows e.g. the creation of arbitrary access log events as well
as querying the 2FA PINs associated with the enrolled chip cards.

2) Hardcoded Legacy Accounts Allowing Control Over Access Managers (CVE-2025-59091)
Multiple hardcoded credentials have been identified, which are allowed to sign-in
to the exos 9300 datapoint server running on port 1004 and 1005. This server is
used for relaying status information from and to the access manager. This information,
among other things, is used to graphically visualize open doors and alerts. However,
controlling the access managers via this interface is also possible.
To send and receive status information, authentication is necessary. The Kaba exos 9300
application contains hard-coded credentials for four different users, which are
allowed to login to the datapoint server and receive as well as send information,
including commands to open arbitrary doors.

3) Unauthenticated RPC Service (CVE-2025-59092)
An RPC service, which is part of exos 9300, is reachable on port 4000, run by
the process FSMobilePhoneInterface.exe. This service is used for interprocess
communication between services and the Kaba exos 9300 GUI, containing status
information about the access managers. Interacting with the service does not
require any authentication. Therefore, it is possible to send arbitrary status
information about door contacts etc. without prior authentication.

4) Insecure Password Derivation Function for Database Administrator (CVE-2025-59093)
Exos 9300 instances are using a randomly generated database password to connect
to the configured MSSQL server. The password is derived from static random values,
which are concatenated to the hostname and a random string that can be read by
every user from the registry. This allows an attacker to derive the database
password and get authenticated access to the central exos 9300 database as the
user "Exos9300Common". The user has the roles "ExosDialog" and "ExosDialogDotNet"
assigned, which are able to read most tables of the database as well as update
and insert into many tables.

5) Local Privilege Escalation in exos 9300 System management (CVE-2025-59094)
A local privilege escalation vulnerability has been identified in the
Kaba exos 9300 System management application (d9sysdef.exe). Within this
application it is possible to specify an arbitrary executable as well as
the weekday and start time, when the specified executable should be run
with SYSTEM privileges.

6) Hard-coded Key for PIN Encryption (CVE-2025-59095)
The program libraries (DLL) and binaries used by exos 9300 contain multiple
hard-coded secrets. One notable example is the function "EncryptAndDecrypt"
in the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption
technique combined with a cryptographic key (cryptoKey) to transform each
character of the input string. However, it's important to note that this
implementation does not provide strong encryption and should not be considered
secure for sensitive data. It's more of a custom encryption approach rather
than a common algorithm used in cryptographic applications. The key itself is
static and based on the founder's name of the company. The functionality is
for example used to encrypt the user PINs before storing them in the MSSQL
database.

7) Weak Default Password (CVE-2025-59096)
The default password for the extended admin user mode in the application
U9ExisAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple
locations as well as documented in the locally stored user documentation.


Proof of concept:
-----------------
1) Unauthenticated SOAP API (CVE-2025-59090)
To create arbitrary access log entries, the following request can be sent
to the exos 9300 server on port 8002:
------Request--------
POST /IIdmm2CommunicationHubService HTTP/1.1
Host: <exos IP>:8002
User-Agent: gSOAP/2.8
Content-Type: application/soap+xml; charset=utf-8; 
action="http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent";
Content-Length: 984
Connection: keep-alive
SOAPAction:"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent";


<?xml version="1.0" encoding="UTF-8"?>
<SOAP-ENV:Envelope
  xmlns:SOAP-ENV="http://www.w3.org/2003/05/soap-envelope";
  xmlns:SOAP-ENC="http://www.w3.org/2003/05/soap-encoding";
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance";
  xmlns:xsd="http://www.w3.org/2001/XMLSchema";
  xmlns:arr="http://schemas.microsoft.com/2003/10/Serialization/Arrays";
  xmlns:ns2="http://kbr.kaba.ch/services/ICommunicationHub2IdmmService";
  xmlns:ns1="http://kbr.kaba.ch/services/IIdmm2CommunicationHubService";>
  <SOAP-ENV:Body>
    <ns1:SetAccessEvent>
      <ns1:identifier>I010001</ns1:identifier>
      <ns1:accessEvent>
        <ns1:BadgeNr>00000000000000061337</ns1:BadgeNr>
        <ns1:DeviceStatus>1</ns1:DeviceStatus>
        <ns1:EventId>10</ns1:EventId>
        <ns1:LogDate>2025-01-01T13:37:00.0000000</ns1:LogDate>
        <ns1:RegistrationUnitInd

References

Raw JSON
{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SEC Consult SA-20260126-0",
          "vendor": "Dormakaba",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "SEC Consult Vulnerability Lab via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "SEC Consult Vulnerability Lab Security Advisory < 20260126-0 >\n=======================================================================\n              title: Multiple Critical Vulnerabilities\n            product: dormakaba Kaba exos 9300\n vulnerable version: < 4.4.1\n      fixed version: 4.4.1\n         CVE number: CVE-2025-59090, CVE-2025-59091, CVE-2025-59092\n                     CVE-2025-59093, CVE-2025-59094, CVE-2025-59095\n                     CVE-2025-59096\n             impact: critical\n           homepage:https://www.dormakaba.com/\n              found: 2024-03-18\n                 by: Clemens Stockenreitner (Office Vienna)\n                     Werner Schober (Office Vienna)\n                     SEC Consult Vulnerability Lab\n\n                     An integrated part of SEC Consult, an Atos business\n                     Europe | Asia\n\n                     https://www.sec-consult.com\n\n=======================================================================\n\nVendor description:\n-------------------\n\"The Kaba exos 9300 basic system is the cornerstone of your access\nmanagement solution. Use it to resolves all your basic employees,\nsystem, user and peripheral management tasks and initiate targeted\nsecurity measures as required. [...] \"\n\nSource:https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000\n\n\nBusiness recommendation:\n------------------------\nThe vendor provides multiple patches which should be installed immediately.\nMore details can be found at the following locations:\n- Solution at the end of this advisory\n- SEC Consult blog post:https://r.sec-consult.com/dormakaba\n- Vendor website / security page:https://www.dormakabagroup.com/en/security-advisories\n- Your dormakaba partner\n\n\nTested Architecture Overview\n-----------------------------------\nThe tested system is the enterprise grade physical access system from\ndormakaba. The tested system consists of the following components:\n\n------------------------------\ndormakaba exos 9300\n------------------------------\nExos 9300 is a piece of software based on C# running on a central Windows server with\nan MSSQL, or Oracle database as central storage.\nExos consists of multiple modules (e.g. basis, employee management, key depot, access,\nvisitor management, 3rd party management). Exos is used to centrally manage users,\nkeys, cards as well as the configuration of the access manager. Devices in the\nexos environment are addressed using a special addressing scheme. The address scheme\ndescribed in the following table is going to be important.\n\n┌────────────────────┬───────────────────────────┬───────────────┬───────────────────────────────────────────┬───────────────────────────┬───────────────────┐\n│         I          │            01             │      00       │                    01                     │          \n  00             │        00         │\n├────────────────────┼───────────────────────────┼───────────────┼───────────────────────────────────────────┼───────────────────────────┼───────────────────┤\n│ Port Type          │ Communication Hub Address │ Port Address  │ Access Hub Address                        │ 00 = \nDoor Manager         │ Datapoint Address │\n│ I = Access Manager │ Values: 01-99             │ Values: 00-99 │ Values: 00-99                             │ 01 = \nAccess Point         │ Values: 00-20     │\n│ B = Serial         │                           │               │ Fixed to 01 for Access Hubs with Ethernet │ 02 = \nTurnstile            │                   │\n│ C = Modem          │                           │               │                                           │ 03 = IO \nController        │                   │\n│ E = Ethernet       │                           │               │                                           │ Fixed to \n00 in most cases │                   │\n│ R = remote         │                           │               │                                           │          \n                 │                   │\n└────────────────────┴───────────────────────────┴───────────────┴───────────────────────────────────────────┴───────────────────────────┴───────────────────┘\n\n------------------------------\ndormakaba Access Manager\n------------------------------\nThe access manager is a component that is configured via exos. The configuration\nbetween exos and access manager is exchanged via a SOAP interface. Per default\nthe data exchange is unencrypted. Encryption is only available starting with\naccess manager hardware release K7.\n\nThe access manager is a custom piece of hardware with multiple inputs and outputs.\nThe device offers the following interfaces:\n- Digital Inputs\n- 3x DC Output Relays\n- 2x RS-232\n- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)\n- 1x RJ45\n- 1x Micro USB\n- 2x Coax (Used to connect registration units e.g. 9001, 9002)\n\nThe tested hardware was an access manager 9200-k5 running Windows CE embedded,\nand an access manager 9200-k7 running Linux.\n\n------------------------------\ndormakaba Registration Unit\n------------------------------\ndormakaba registration units can be either a Legic/Mifare card reader,\nor a PIN pad used to enter a PIN to deactivate alarming systems, or as\nan additional authentication.\n\n------------------------------\nElectric lock\n------------------------------\nThe lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock\nis simply controlled via a relay contact connected to the access manager. As\nsoon as a user successfully authenticates with a registration unit,\nthe relay connected to the lock is switched and the door opens.\n\nThe system is depicted in the following diagram.\n\n          ┌─────────┐\n          │         │\n          │exos 9300│              ┌──────────┐  ┌──────────┐\n          │         │              │ Reg Unit │  │ Pin Pad  │\n          └────┬────┘              │   ┌──┐   │  │  x x x   │\n               │                   │   │┼┼│   │  │  x x x   │\nEthernet──────►│                   │   └──┘   │  │  x x x   │\n               │                   │   9001   │  │   9002   │\n          ┌────┴────┐              └─────┬────┘  └─────┬────┘\n          │ Access  │                    │             │\n          │ Manager ├────────────────────┴─────────────┘\n          │  9200   │        ▲\n          └────┬────┘        │\n               │           Coax\n               │\n  DC Relay───► │\n               │\n            ┌──┴──┐\n            │     │\n            │     │\n            │     │\n            │    ─┤◄──────Electric Lock\n            │     │\n            │     │\n            └─────┘\n\n\nVulnerability overview/description:\n-----------------------------------\n1) Unauthenticated SOAP API (CVE-2025-59090)\nOn the exos 9300 server, a SOAP API is reachable on port 8002. This API does not\nrequire any authentication prior to sending requests. Therefore, network access\nto the exos server allows e.g. the creation of arbitrary access log events as well\nas querying the 2FA PINs associated with the enrolled chip cards.\n\n2) Hardcoded Legacy Accounts Allowing Control Over Access Managers (CVE-2025-59091)\nMultiple hardcoded credentials have been identified, which are allowed to sign-in\nto the exos 9300 datapoint server running on port 1004 and 1005. This server is\nused for relaying status information from and to the access manager. This information,\namong other things, is used to graphically visualize open doors and alerts. However,\ncontrolling the access managers via this interface is also possible.\nTo send and receive status information, authentication is necessary. The Kaba exos 9300\napplication contains hard-coded credentials for four different users, which are\nallowed to login to the datapoint server and receive as well as send information,\nincluding commands to open arbitrary doors.\n\n3) Unauthenticated RPC Service (CVE-2025-59092)\nAn RPC service, which is part of exos 9300, is reachable on port 4000, run by\nthe process FSMobilePhoneInterface.exe. This service is used for interprocess\ncommunication between services and the Kaba exos 9300 GUI, containing status\ninformation about the access managers. Interacting with the service does not\nrequire any authentication. Therefore, it is possible to send arbitrary status\ninformation about door contacts etc. without prior authentication.\n\n4) Insecure Password Derivation Function for Database Administrator (CVE-2025-59093)\nExos 9300 instances are using a randomly generated database password to connect\nto the configured MSSQL server. The password is derived from static random values,\nwhich are concatenated to the hostname and a random string that can be read by\nevery user from the registry. This allows an attacker to derive the database\npassword and get authenticated access to the central exos 9300 database as the\nuser \"Exos9300Common\". The user has the roles \"ExosDialog\" and \"ExosDialogDotNet\"\nassigned, which are able to read most tables of the database as well as update\nand insert into many tables.\n\n5) Local Privilege Escalation in exos 9300 System management (CVE-2025-59094)\nA local privilege escalation vulnerability has been identified in the\nKaba exos 9300 System management application (d9sysdef.exe). Within this\napplication it is possible to specify an arbitrary executable as well as\nthe weekday and start time, when the specified executable should be run\nwith SYSTEM privileges.\n\n6) Hard-coded Key for PIN Encryption (CVE-2025-59095)\nThe program libraries (DLL) and binaries used by exos 9300 contain multiple\nhard-coded secrets. One notable example is the function \"EncryptAndDecrypt\"\nin the library Kaba.EXOS.common.dll. This algorithm uses a simple XOR encryption\ntechnique combined with a cryptographic key (cryptoKey) to transform each\ncharacter of the input string. However, it's important to note that this\nimplementation does not provide strong encryption and should not be considered\nsecure for sensitive data. It's more of a custom encryption approach rather\nthan a common algorithm used in cryptographic applications. The key itself is\nstatic and based on the founder's name of the company. The functionality is\nfor example used to encrypt the user PINs before storing them in the MSSQL\ndatabase.\n\n7) Weak Default Password (CVE-2025-59096)\nThe default password for the extended admin user mode in the application\nU9ExisAdmin.exe (\"Kaba 9300 Administration\") is hard-coded in multiple\nlocations as well as documented in the locally stored user documentation.\n\n\nProof of concept:\n-----------------\n1) Unauthenticated SOAP API (CVE-2025-59090)\nTo create arbitrary access log entries, the following request can be sent\nto the exos 9300 server on port 8002:\n------Request--------\nPOST /IIdmm2CommunicationHubService HTTP/1.1\nHost: <exos IP>:8002\nUser-Agent: gSOAP/2.8\nContent-Type: application/soap+xml; charset=utf-8; \naction=\"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent\";\nContent-Length: 984\nConnection: keep-alive\nSOAPAction:\"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent\";\n\n\n<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<SOAP-ENV:Envelope\n  xmlns:SOAP-ENV=\"http://www.w3.org/2003/05/soap-envelope\";\n  xmlns:SOAP-ENC=\"http://www.w3.org/2003/05/soap-encoding\";\n  xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\";\n  xmlns:xsd=\"http://www.w3.org/2001/XMLSchema\";\n  xmlns:arr=\"http://schemas.microsoft.com/2003/10/Serialization/Arrays\";\n  xmlns:ns2=\"http://kbr.kaba.ch/services/ICommunicationHub2IdmmService\";\n  xmlns:ns1=\"http://kbr.kaba.ch/services/IIdmm2CommunicationHubService\";>\n  <SOAP-ENV:Body>\n    <ns1:SetAccessEvent>\n      <ns1:identifier>I010001</ns1:identifier>\n      <ns1:accessEvent>\n        <ns1:BadgeNr>00000000000000061337</ns1:BadgeNr>\n        <ns1:DeviceStatus>1</ns1:DeviceStatus>\n        <ns1:EventId>10</ns1:EventId>\n        <ns1:LogDate>2025-01-01T13:37:00.0000000</ns1:LogDate>\n        <ns1:RegistrationUnitInd"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-09T13:31:52Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/22"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Jan/22"
        },
        {
          "url": "http://kbr.kaba.ch/services/ICommunicationHub2IdmmService\""
        },
        {
          "url": "http://kbr.kaba.ch/services/IIdmm2CommunicationHubService\""
        },
        {
          "url": "http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/GetPerson\""
        },
        {
          "url": "http://kbr.kaba.ch/services/IIdmm2CommunicationHubService/IIdmm2CommunicationHubService/SetAccessEvent\""
        },
        {
          "url": "http://schemas.microsoft.com/2003/10/Serialization/Arrays\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema\""
        },
        {
          "url": "http://www.w3.org/2001/XMLSchema-instance\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-encoding\""
        },
        {
          "url": "http://www.w3.org/2003/05/soap-envelope\""
        },
        {
          "url": "https://blog.sec-consult.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://r.sec-consult.com/dormakaba"
        },
        {
          "url": "https://sec-consult.com/career/"
        },
        {
          "url": "https://sec-consult.com/contact/"
        },
        {
          "url": "https://sec-consult.com/vulnerability-lab/"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.dormakaba.com/"
        },
        {
          "url": "https://www.dormakaba.com/gb-en/offering/products/electronic-access-data/corporate-access-control-solutions/dormakaba-exos-9300-base-system--ka_500000"
        },
        {
          "url": "https://www.dormakabagroup.com/en/security-advisories"
        },
        {
          "url": "https://www.sec-consult.com"
        },
        {
          "url": "https://x.com/sec_consult"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Jan/22"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SEC Consult SA-20260126-0 :: Multiple Critical Vulnerabilities in dormakaba Kaba exos 9300",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2025-59090",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59091",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59092",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59093",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59094",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59095",
              "type": "related"
            },
            {
              "destId": "CVE-2025-59096",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0190",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Jan/22",
            "automated": true,
            "contentSha256": "12b4aaf996246ad094c3f964daefe5f4d02a99bdadb4812f6683e101abe33c1c",
            "evidenceScore": 9,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Jan/22",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-01-26T10:21:32Z"
          }
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-09-08T07:57:41Z",
    "dateUpdated": "2026-09-09T13:31:52Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0190"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}