CVE-2025-59093CWE-656

Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300

High · published January 26, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
7.5
In the wild
Unconfirmed
What it is

Exos 9300 instances are using a randomly generated database password to connect to the configured MSSQL server. The password is derived from static random values, which are concatenated to the hostname and a random string that can be read by every user from the registry. This allows an attacker to derive the database password and get authenticated access to the central exos 9300 database as the user Exos9300Common. The user has the roles ExosDialog and ExosDialogDotNet assigned, which are able to read most tables of the database as well as update and insert into many tables.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00179 · 7.5th percentile
Weakness
CWE-656 · Reliance on Security Through Obscurity
Published
2026-01-26T10:03Z
EPSS history
Timeline
  • 26 JAN 10:03Z
    Insecure Password Derivation Function for Database Administrator in dormakaba Kaba exos 9300
    cvelistv5