Vulnerability details
CVE-2025-59094
dormakaba Kaba exos 9300
Local Privilege Escalation in dormakaba Kaba exos 9300 System management
CVSS 4.0
8.4High
Official description
A local privilege escalation vulnerability has been identified in the Kaba exos 9300 System management application (d9sysdef.exe). Within this application it is possible to specify an arbitrary executable as well as the weekday and start time, when the specified executable should be run with SYSTEM privileges.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.4High | 4.0 | CVEProject cvelistV5 (CNA) (SEC-VLab) | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| dormakaba | Kaba exos 9300 | All versions, manual mitigation needed! | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://r.sec-consult.com/dormakaba technical-description
- https://r.sec-consult.com/dkexos third-party-advisory
- https://www.dormakabagroup.com/en/security-advisories vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-26
- Last updated
- 2026-01-26
- State
- Published
- Assigner (CNA)
- SEC-VLab
Exploit prediction (EPSS)
0.16%
Probability of exploitation in 30 days
5.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-269Improper Privilege Management