Management Summary
This advisory details multiple critical vulnerabilities affecting dormakabas enterprise grade physical access management systems built on exos 9300, a widely deployed platform for physical access control. When exploited, these flaws could allow an attacker to unlock arbitrary doors through multiple attack paths, reconfigure connected controllers and peripherals without any prior authentication, and gain extensive unauthorized control over physical access infrastructure. The advisories are split into three parts (exos9300, access manager, registration unit). This part covers the registration unit 9002 (PIN pad).
Vendor description
"The Kaba exos 9300 basic system is the cornerstone of your access management solution. Use it to resolves all your basic employees, system, user and peripheral management tasks and initiate targeted security measures as required. [...] "
Source: dormakaba.com
Business recommendation
The vendor provides multiple patches which should be installed immediately. More details can be found at the following locations:
- Solution at the end of this advisory
- SEC Consult blog post: https://r.sec-consult.com/dormakaba
- Vendor website / security page: https://www.dormakabagroup.com/en/security-advisories
- Your dormakaba partner
Tested Architecture Overview
The tested system is the enterprise grade physical access system from dormakaba. The tested system consists of the following components:
dormakaba exos 9300
Exos 9300 is a piece of software based on C# running on a central Windows server with an MSSQL, or Oracle database as central storage. Exos consists of multiple modules (e.g. basis, employee management, key depot, access, visitor management, 3rd party management). Exos is used to centrally manage users, keys, cards as well as the configuration of the access manager. Devices in the exos environment are addressed using a special addressing scheme. The address scheme described in the following table is going to be important.
┌────────────────────┬───────────────────────────┬───────────────┬───────────────────────────────────────────┬───────────────────────────┬───────────────────┐
│ I │ 01 │ 00 │ 01 │ 00 │ 00 │
├────────────────────┼───────────────────────────┼───────────────┼───────────────────────────────────────────┼───────────────────────────┼───────────────────┤
│ Port Type │ Communication Hub Address │ Port Address │ Access Hub Address │ 00 = Door Manager │ Datapoint Address │
│ I = Access Manager │ Values: 01-99 │ Values: 00-99 │ Values: 00-99 │ 01 = Access Point │ Values: 00-20 │
│ B = Serial │ │ │ Fixed to 01 for Access Hubs with Ethernet │ 02 = Turnstile │ │
│ C = Modem │ │ │ │ 03 = IO Controller │ │
│ E = Ethernet │ │ │ │ Fixed to 00 in most cases │ │
│ R = remote │ │ │ │ │ │
└────────────────────┴───────────────────────────┴───────────────┴───────────────────────────────────────────┴───────────────────────────┴───────────────────┘dormakaba Access Manager
The access manager is a component that is configured via exos. The configuration between exos and access manager is exchanged via a SOAP interface. Per default the data exchange is unencrypted. Encryption is only available starting with access manager hardware release K7.
The access manager is a custom piece of hardware with multiple inputs and outputs.
The device offers the following interfaces:
- Digital Inputs
- 3x DC Output Relays
- 2x RS-232
- 1x RS-485 (Used to connect to access manager extension systems e.g. Kaba 9125)
- 1x RJ45
- 1x Micro USB
- 2x Coax (Used to connect registration units e.g. 9001, 9002)
The tested hardware was an access manager 9200-k5 running Windows CE embedded, and an access manager 9200-k7 running Linux.
dormakaba Registration Unit
dormakaba registration units can be either a Legic/Mifare card reader, or a PIN pad used to enter a PIN to deactivate alarming systems, or as an additional authentication.
Electric lock
The lock used for the tested setup is an Assa Abloy/effeff Profix 118. The lock is simply controlled via a relay contact connected to the access manager. As soon as a user successfully authenticates with a registration unit, the relay connected to the lock is switched and the door opens.
The system is depicted in the following diagram:
┌─────────┐
│ │
│exos 9300│ ┌──────────┐ ┌──────────┐
│ │ │ Reg Unit │ │ Pin Pad │
└────┬────┘ │ ┌──┐ │ │ x x x │
│ │ │┼┼│ │ │ x x x │
Ethernet──────►│ │ └──┘ │ │ x x x │
│ │ 9001 │ │ 9002 │
┌────┴────┐ └─────┬────┘ └─────┬────┘
│ Access │ │ │
│ Manager ├────────────────────┴─────────────┘
│ 9200 │ ▲
└────┬────┘ │
│ Coax
│
DC Relay───► │
│
┌──┴──┐
│ │
│ │
│ │
│ ─┤◄──────Electric Lock
│ │
│ │
└─────┘ Vulnerability overview/description
1) UART Leaking Sensitive Data (CVE-2025-59109)
The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an attacker is easily able to remove the device, install a hardware implant which connects to the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).
Proof of concept
1) UART Leaking Sensitive Data (CVE-2025-59109)
To verify that the UART interface actually sends the entered numbers, wires have been soldered to the board of the keypad. Using a baud rate of 57.600, one stop bit and no parity bits, the data keystrokes can be received.
The received output then includes the pressed keys, and the coordinates of the pressed key in the following format.
1,1324,0395,
5,1294,0386,
8,1290,0398,
6,1294,0388,
6,1294,0403,
E,1304,0374,Vulnerable / tested versions
All hardware revisions with a firmware version <SW0039, which was the latest version available at the time of the test, are vulnerable.