CVE-2025-59106
Dormakabagroup Dormakaba Access Manager 9200-K7 Firmware ≤ bame_06.00
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-59106 is a high-severity Least Privilege Violation (CWE-272) vulnerability in Dormakabagroup Dormakaba Access Manager 9200-K7 Firmware. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 49th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-59106, published on 2026-01-26, is a least privilege violation (CWE-272) with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It affects the binary in dormakaba access control systems, such as dkaccess, that serves the web server and executes actions initiated from the Web UI. This binary runs with root privileges, contravening the principle of least privilege and enabling potential escalation if initial code execution is achieved through other vulnerabilities.
An attacker with low privileges, such as an authenticated user with network access, can exploit this issue in conjunction with another vulnerability that allows code execution on the system. Successful exploitation grants direct execution of commands with root privileges, resulting in high-impact compromise of confidentiality, integrity, and availability.
Mitigation details are available in advisories from SEC Consult (https://r.sec-consult.com/dkaccess, https://r.sec-consult.com/dormakaba) and dormakaba (https://www.dormakabagroup.com/en/security-advisories).
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206378
Vulnerability Data
The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via…
more
other vulnerabilities it is possible to directly execute commands with highest privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
AC-6 directly requires employing least privilege so that elevated rights are granted only when needed and revoked immediately afterward.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Directly enforces least-privilege policy and ongoing review that prevents failure to drop elevated rights after privileged operations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Restricts and monitors privileged utility programs, directly addressing the need to drop elevated rights immediately after use.
Privileged access rights explicitly require least-privilege assignment and timely revocation after elevated operations.
Secure coding practices can prevent least-privilege violations but do not constitute the control itself.
Information access restriction supports least privilege but does not specifically mandate dropping rights after privileged operations.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Ubuntu 24.04 (1 rule)
- V-270689 Ubuntu 24.04 LTS must prevent all software from executing at higher privilege levels than users executing the software and the audit system must be configured to audit the execution of privileged functions. prevents CWE-272
Windows 10 (1 rule)
- V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-272
Windows Server 2022 (1 rule)
- V-254428 Windows Server 2022 must only allow administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-272