CVE-2025-59103

The Access Manager 92xx (K7) device runs on Linux and exposes an SSH service on port 22. Two accounts with hardcoded and easily guessable passwords were detected in the firmware. One user's password is changed to a random value after initial deployment, however randomization occurs only when the configured system date is earlier than the year 2022. If the device clock was never set, the clock module battery was replaced, the device was reset to factory settings, or has not yet received time synchronization — passwords are not randomized and remain default values.

An attacker with network access to port 22 can log into the device using known or easily guessable passwords, gaining unauthorized access to the operating system of the access control device — which may lead to takeover of physical security infrastructure.

Apply patches available from the manufacturer according to the references. It is also recommended to immediately restrict network access to port 22 (SSH) at the firewall or network segmentation level, and to verify and manually change passwords on all devices whose system clock was not properly configured or which have been reset to factory settings.

dormakaba Access Manager 92xx in hardware revision K7 with Linux-based software