Unauthenticated TCP Socket Vulnerability in Access Manager from dormakaba

CVE-2025-59098

What is CVE-2025-59098?

The Access Manager from dormakaba has a vulnerability that exposes sensitive data through a continuously broadcasted TCP socket without any authentication or encryption. A tool named TraceClient.exe, provided through the Access Manager web interface, allows access to this socket, enabling an attacker with network-level access to retrieve critical information. This includes sensitive data such as Card IDs and entered PINs from Registration units, which can be exploited if the verbosity level is misconfigured or can be guessed via the SOAP interface. Proper security measures should be employed to mitigate unauthorized access and ensure sensitive data integrity.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References