CVE-2025-59106

published 2026-01-26

CVE-2025-59106: The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least…

Priority P2 62 high 8.8 CVSS 3.1

AV N AC L PR L UI N S U C H I H A H

The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
dormakaba	access_manager_92xx-k7	—	—
dormakabagroup	dormakaba_access_manager_9200-k7_firmware	< bame_06.00	bame_06.00
dormakabagroup	dormakaba_access_manager_9230-k7_firmware	< bame_06.00	bame_06.00
dormakabagroup	dormakaba_access_manager_9290-k7_firmware	< bame_06.00	bame_06.00

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-272