CVE-2025-59108CWE-1392

Weak Default Passwords in dormakaba access manager

Critical · published January 26, 2026

CVSS v4.0
9.2
EPSS
0%
Percentile
38.1
In the wild
Unconfirmed
What it is

By default, the password for the Access Manager's web interface, is set to 'admin'. In the tested version changing the password was not enforced.

The record
Technical detail
CVSS v4.0
9.2 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00450 · 38.1th percentile
Weakness
CWE-1392 · Use of Default Credentials
Published
2026-01-26T10:06Z
EPSS history
Timeline
  • 26 JAN 10:06Z
    Weak Default Passwords in dormakaba access manager
    cvelistv5