QwikSec

Security Database

CVE

CWE

Training

CVE-2025-59107

Published: Jan 26, 2026

Modified: Jan 26, 2026

PUBLISHED

Description

Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.

Vendor	Product	Versions
dormakaba	Access Manager 92xx-k5	affected `All versions`

Weaknesses (CWE)

References

https://r.sec-consult.com/dormakaba

technical-description

https://r.sec-consult.com/dkaccess

third-party-advisory

https://www.dormakabagroup.com/en/security-advisories

vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.