CVE-2025-59107CWE-798

Static Firmware Encryption Password in dormakaba access manager

High · published January 26, 2026

CVSS v4.0
8.5
EPSS
0%
Percentile
7.0
In the wild
Unconfirmed
What it is

Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.

The record
Technical detail
CVSS v4.0
8.5 · HIGH
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00177 · 7.0th percentile
Weakness
CWE-798 · Use of Hard-coded Credentials
Published
2026-01-26T10:06Z
EPSS history
Timeline
  • 26 JAN 10:06Z
    Static Firmware Encryption Password in dormakaba access manager
    cvelistv5