CVE-2025-59105
Flash Memory Tampering Enables Root Access on Linux K7 Devices
Publication date: 2026-01-26
Last updated on: 2026-01-26
Assigner: SEC Consult Vulnerability Lab
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dormakaba | access_manager | to BAME_06.00 (exc) |
| dormakaba | access_manager | From BAME_04.07.268 (exc) |
| dormakaba | access_manager | From BAME_05.01.88 (exc) |
| dormakaba | access_manager | From BAME_06.00 (exc) |
| dormakaba | access_manager | to XAMB_04.06.212 (exc) |
| dormakaba | access_manager | to XAMB_04.05.21 (exc) |
| dormakaba | access_manager | to BAME_04.05.16 (exc) |
| dormakaba | access_manager | to BAME_04.07.268 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-312 | The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, restrict physical access to the affected devices to prevent attackers from desoldering and modifying the flash memory. Additionally, consider implementing hardware-level encryption for flash memory to protect stored sensitive files and credentials. Since the vulnerability involves missing encryption and physical tampering, physical security controls are critical.
Can you explain this vulnerability to me?
This vulnerability allows an attacker with physical access to the device and sufficient time to desolder the flash memory, modify its contents, and then reinstall it because the flash memory is not encrypted. This enables the attacker to read and modify essential files such as /etc/passwd, stored certificates, cryptographic keys, and stored PINs. On the Linux-based K7 model, this can lead to gaining SSH root access. On the Windows CE based K5 model, the password for the Access Manager can be read in plain text from the stored SQLite database.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized access to the device with root privileges on Linux-based K7 models, allowing an attacker to control the system via SSH. It also exposes sensitive information such as stored certificates, cryptographic keys, and PINs, which can be used for further attacks or impersonation. On Windows CE based K5 models, the Access Manager password can be obtained in plain text, compromising access control. Overall, this can result in a complete compromise of the device's security and confidentiality.