Loading story…
Researchers disclosed 20+ vulnerabilities in Dormakaba physical access control products—centered on the Exos central management software (including Exos 9300), an access manager, and registration units (e.g., PIN pad/fingerprint/chip-card readers)—that could enable attackers with network access to unlock arbitrary doors, reconfigure controllers/peripherals, and potentially pivot further into affected environments. Reported weakness classes include hardcoded credentials/keys, weak or insecure password handling, missing authentication, local privilege escalation, data exposure, path traversal, and command injection.
Dormakaba stated exploitation generally requires prior access to the customer’s infrastructure (network or hardware), but researchers identified internet-exposed deployments that could be targeted remotely due to exposure/misconfiguration. The affected install base is described as several thousand customers, including a subset with high-security requirements (e.g., industrial, energy, logistics, and airport operators). Dormakaba has been working over an extended period to deliver patches and hardening guidance and to coordinate remediation with major customers.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
SEC Consult publicly disclosed the vulnerabilities after assisting with remediation and published a proof-of-concept demonstration showing door opening via specially crafted requests. The disclosure highlighted the risk of arbitrary door unlocking, controller reconfiguration, and theft of access PINs.
Dormakaba stated that several thousand customers were potentially impacted by the vulnerabilities, including a small proportion operating in high-security environments such as critical infrastructure, energy, logistics, and airports. The company also said it was not aware of exploitation in the wild at the time of disclosure.
SEC Consult reported discovering dozens of vulnerable Dormakaba systems exposed to the internet, including access managers with web login pages and SOAP APIs reachable directly online. This meant some deployments could potentially be attacked remotely without first compromising an internal network.
SEC Consult found more than 20 vulnerabilities in Dormakaba physical access control products, including hardcoded credentials and keys, weak password mechanisms, missing authentication, path traversal, command injection, privilege escalation, and data exposure issues. The flaws affected exos 9300-related components and could allow attackers to unlock doors, reconfigure controllers, and access sensitive data.
Dormakaba said it had been working for roughly 18 months on patches, hardening guidance, and customer remediation for vulnerabilities affecting its exos 9300 physical access control ecosystem. The effort covered central management software, access managers, and registration units used in large European enterprise deployments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityaffairs.com
Open sourcesecurityweek.com
Open sourcereddit.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical vulnerability in the MajorDoMo home automation platform, tracked as **`CVE-2026-27174`**, allows unauthenticated remote code execution on internet-facing servers. The flaw stems from improper authentication handling in **`/admin.php`**, where requests continue to be processed after a redirect, combined with unsafe use of PHP **`eval()`** on attacker-controlled input in an internal AJAX console/debugging component. Researchers reported that a single crafted HTTP GET request can reach the internal handler and execute arbitrary PHP code without valid credentials. Successful exploitation can give attackers full server compromise, including the ability to run system commands, read sensitive files, steal credentials, and deploy persistent web shells. Because MajorDoMo is often used to manage cameras, sensors, locks, and other building or home automation systems, a breach can also expose connected IoT environments and support lateral movement into internal networks. Public detection content, including a **Nuclei** template, is already available, raising the risk of rapid exploitation, and defenders have been urged to apply the vendor patch, restrict admin access to trusted networks, place the interface behind a VPN or authenticated reverse proxy, disable the console feature where possible, audit logs, and rotate secrets.
Jun 29, 2026
Researchers detailed how **CVE-2022-35405**, a pre-authentication remote code execution flaw in **Zoho/ManageEngine Password Manager Pro**, could let an internet-based attacker take over the password vault server through its XML-RPC functionality. The issue was tied to insecure deserialization behavior, aligning with broader OWASP guidance that deserialization flaws can allow untrusted data to trigger arbitrary code execution when applications process attacker-controlled objects. After gaining code execution on a vulnerable Password Manager Pro instance, red-team researchers showed they could reverse engineer the product’s server-side cryptography and recover sensitive secrets, including the stored database password, the master key, and plaintext managed credentials. Their analysis of the default PostgreSQL deployment found that the server’s ability to decrypt secrets on behalf of users created a **single point of failure**: once the PMP server was compromised, attackers could extract vaulted credentials and use them to escalate access, potentially reaching **Domain Admin** in enterprise environments.
Jul 24, 2026
Moxa disclosed and patched **CVE-2024-12297**, a critical authorization flaw in multiple industrial Ethernet switch lines that can let a remote, unauthenticated attacker bypass authentication and access device functions. The vulnerability stems from weaknesses in frontend authorization logic and client-side versus back-end verification, allowing brute-force credential guessing and potential **MD5 collision** attacks to forge authentication hashes. Moxa rated the issue **CVSS 9.2** and said exploitation could expose sensitive configurations or disrupt services on affected switches. The flaw initially affected the **EDS-508A Series** on firmware `3.11` and earlier, and advisories later expanded coverage to additional **EDS**, **SDS**, and **PT series** models, including PT-508, PT-510, PT-7528, PT-7728, PT-7828, PT-G503, PT-G510, PT-G7728, and PT-G7828 below specified fixed versions. Moxa issued firmware updates for most impacted products and told some EDS-508A customers to obtain patches through technical support. The company also urged operators to minimize Internet exposure, restrict SSH and management access to trusted networks, apply least privilege and MFA where possible, and strengthen logging, IDS/IPS, and network monitoring around affected operational technology environments.
Jul 24, 2026