Access Manager
by dormakaba
CVEs (4)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-59108 | Cri | 0.60 | — | 0.00 | Jan 26, 2026 | By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced. | ||
| CVE-2025-59099 | Hig | 0.57 | — | 0.01 | Jan 26, 2026 | The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. Hence, it is possible… | ||
| CVE-2025-59098 | Hig | 0.57 | — | 0.00 | Jan 26, 2026 | The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the… | ||
| CVE-2025-59101 | Hig | 0.50 | — | 0.01 | Jan 26, 2026 | Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other… |
- risk 0.60cvss —epss 0.00
By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.
- risk 0.57cvss —epss 0.01
The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. Hence, it is possible…
- risk 0.57cvss —epss 0.00
The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the…
- risk 0.50cvss —epss 0.01
Instead of typical session tokens or cookies, it is verified on a per-request basis if the originating IP address has once successfully logged in. As soon as an authentication request from a certain source IP is successful, the IP address is handled as authenticated. No other…