Dormakaba access systems vulnerable to remote door unlocking

SCM feed for Latest

January 28, 2026 at 6:29 PM

Overview

SEC Consult has identified several security vulnerabilities in Dormakaba's exos 9300 access systems, including hardcoded credentials, weak passwords, and command injection flaws. These vulnerabilities could allow attackers to remotely unlock doors, posing a significant risk to physical security in facilities that rely on these systems. Dormakaba, a leading provider of access control solutions, serves a wide range of industries, meaning many organizations could be affected. Users of the exos 9300 need to be aware of these vulnerabilities and take immediate action to secure their systems to prevent unauthorized access. The findings emphasize the need for strong security practices in access control systems, especially in critical infrastructure.

Key Takeaways

Affected Systems: Dormakaba exos 9300 access systems
Action Required: Users should change hardcoded credentials and implement stronger password policies.
Timeline: Newly disclosed

Original Article Summary

The security flaws, including hardcoded credentials, weak passwords, and command injection, were identified by SEC Consult in the exos 9300 ecosystem.

Impact

Dormakaba exos 9300 access systems

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

Users should change hardcoded credentials and implement stronger password policies. Regular security audits and updates should be performed to mitigate command injection risks.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Critical.

Read Original Article

Related Coverage

Cosmetics giant Rituals discloses data breach affecting customers

BleepingComputer

Rituals, a Dutch cosmetics company, has reported a data breach that has compromised the personal information of customers in its 'My Rituals' membership database. While the exact number of affected individuals remains undisclosed, the breach raises concerns about the security of customer data in an era where personal information is increasingly targeted by cybercriminals. This incident serves as a reminder for companies to prioritize data protection measures and for customers to be vigilant about their personal information. Rituals has yet to provide detailed guidance on how affected customers can protect themselves or what steps the company is taking to address the breach. Such breaches can lead to identity theft and other security risks, making it crucial for both companies and consumers to take proactive measures against data vulnerabilities.

Apr 23, 2026

Apple Fixes iOS Notification Bug Exposing Deleted Messages

Infosecurity Magazine

Apple has addressed a significant flaw in iOS that allowed deleted notifications to linger and expose message content. This vulnerability could potentially let others view sensitive information even after users thought they had deleted it. Affected users include anyone running iOS versions prior to the fix, which was rolled out in a recent update. The issue raises concerns about privacy, as it could lead to unintended sharing of personal messages. Apple has encouraged users to update their devices to ensure their information remains secure.

Apr 23, 2026

Chinese Cybersecurity Firm’s AI Hacking Claims Draw Comparisons to Claude Mythos

SecurityWeek

360 Digital Security Group, a Chinese cybersecurity firm, claims to have identified 1,000 vulnerabilities using artificial intelligence. This includes findings from the Tianfu Cup hacking contest, which is known for showcasing talent in cybersecurity. The firm's assertion raises eyebrows as it draws comparisons to previous claims made by Claude Mythos, a controversial figure in the cybersecurity space. The significance of these findings lies in the potential implications for software and systems security, as vulnerabilities can be exploited by malicious actors. Companies and developers should take note of these claims and assess their products for the identified vulnerabilities to bolster their defenses.

Apr 23, 2026

If cyber espionage via HDMI worries you, NCSC built a device to stop it

Help Net Security

The National Cyber Security Centre (NCSC) has introduced a new device called SilentGlass, aimed at preventing cyber espionage through HDMI and DisplayPort connections. This plug-and-play tool addresses concerns that monitors can be exploited by attackers to access sensitive data, as they often process and store such information. By securing these display links, SilentGlass provides a protective measure for governments and businesses against potential cyber threats. The NCSC emphasizes the need for enhanced security in this area, given the increasing risks posed by malicious activities targeting display devices. This development is particularly relevant as organizations look for effective ways to safeguard their data from evolving cyber threats.

Apr 23, 2026

The Behavioral Shift: Why Trusted Relationships Are the Newest Attack Surface

SecurityWeek

Recent research from Abnormal AI indicates a shift in how cyber attackers operate. Instead of relying on technical exploits, they are now targeting established workflows and the trust that exists within organizations. This means that attackers are using social engineering tactics to manipulate employees into compromise, effectively weaponizing the very relationships that businesses rely on. This trend raises concerns for companies as it highlights the vulnerability of internal processes and trust dynamics. Organizations need to reassess their security measures to address this evolving threat, as traditional defenses may not be sufficient to combat these new tactics.

Apr 23, 2026

AI-driven attacks target governments, cloud agents, supply chains

SCM feed for Latest

Recent research from OWASP reveals that AI-driven attacks are increasingly targeting critical sectors, including government agencies, cloud service providers, and supply chains. These sophisticated attacks leverage artificial intelligence to automate and enhance their effectiveness, making them harder to detect and prevent. The impact of these attacks is significant, as they can compromise sensitive data and disrupt essential services. Organizations in the affected sectors need to be vigilant and adopt stronger security measures to defend against these evolving threats. As AI technology continues to advance, the risk of such attacks is likely to grow, necessitating a proactive approach to cybersecurity.

Apr 23, 2026