CVE-2025-59109
UART Leaking Sensitive Data in dormakaba registration unit 9002
- Published
- Updated
- Reserved
- Assigned by
- SEC-VLab
Description
The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an attacker is easily able to remove the device, install a hardware implant which connects to the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).
Timeline
ID reserved
By SEC-VLab
- 5 months later
· 5 months later
Published
- 36 days later
· 36 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| SEC-VLabCNA (assigner) | 4.0 | Medium5.1 | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
| NVDNVD · Deferred | 4.0 | Medium5.1 | CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.45% · top 61% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.1.
Weakness
Affected products
dormakaba · dormakaba registration unit 9002
- affected <SW0039
What to do
Solution: If the 9002 is installed in an insecure location, it could be manipulated. Hardware access and special equipment is needed to exploit this vulnerability. Also, the manipulated device would need to be reinstalled. To mitigate this vulnerability for 9002 in insecure locations, a newer version of the 9002 (Serial number starts with: 0700039…) could be installed. Important: The version of the installed 9002 can only be checked on-site.
References (4)
- https://r.sec-consult.com/dormakaba (opens in a new tab)technical-description
- https://r.sec-consult.com/dkaccess (opens in a new tab)third-party-advisory
- https://www.dormakabagroup.com/en/security-advisories (opens in a new tab)vendor-advisory
- http://seclists.org/fulldisclosure/2026/Jan/24 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2025-59109)Record last updated .