CVE-2025-59109
UART Data Exposure in dormakaba 9002 PIN Pads Enables PIN Theft
Publication date: 2026-01-26
Last updated on: 2026-01-27
Assigner: SEC Consult Vulnerability Lab
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| dormakaba | exos_9300 | * |
| dormakaba | access_manager | * |
| dormakaba | registration_unit_9002 | * |
| dormakaba | access_manager | to BAME_06.00 (exc) |
| dormakaba | access_manager | From XAMB_04.06.212 (exc) |
| dormakaba | access_manager | From BAME_05.02.156 (exc) |
| dormakaba | access_manager | From XAMB_04.05.21 (exc) |
| dormakaba | access_manager | From BAME_04.05.16 (exc) |
| dormakaba | access_manager | From BAME_04.07.268 (exc) |
| dormakaba | access_manager | From BAME_05.01.88 (exc) |
| dormakaba | access_manager | From BAME_06.00 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1295 | The product fails to adequately prevent the revealing of unnecessary and potentially sensitive system information within debugging messages. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This vulnerability can lead to the exposure of sensitive PIN information entered on the PIN pad. An attacker with physical access can capture and exfiltrate PINs, potentially compromising user authentication and security. This could result in unauthorized access to systems or accounts protected by these PINs.
Can you explain this vulnerability to me?
The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad sends every button press to this UART interface. An attacker can physically access this interface to capture and exfiltrate PINs entered on the device. Because the devices are designed to be easily replaced (Plug-and-Play), an attacker can remove the device, install a hardware implant connected to the UART, and then exfiltrate the captured data to another system, for example via WiFi.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately restrict physical access to the dormakaba registration units 9002 PIN Pad devices to prevent attackers from removing the device and installing hardware implants. Additionally, inspect the backside of the devices for any unauthorized hardware connected to the UART header. Consider implementing physical tamper-evident seals or enclosures to deter unauthorized access. Since the vulnerability involves data exfiltration via UART, disabling or securing the UART interface if possible would also help mitigate the risk.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows attackers with physical access to exfiltrate PINs by intercepting unencrypted data transmitted via the exposed UART interface on the dormakaba registration unit 9002 PIN pad. This exposure of sensitive authentication data can lead to unauthorized access and compromise of physical security systems. Such unauthorized disclosure and potential misuse of personal authentication data can negatively impact compliance with data protection regulations like GDPR and security standards such as HIPAA, which require protection of sensitive personal and authentication information. However, no explicit mention of compliance impact or regulatory consequences is provided in the available resources. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves an exposed UART interface on the backside of dormakaba registration unit 9002 PIN pads that transmits every button press unencrypted. Detection involves physical inspection of the device to identify the exposed UART header. Since the data is transmitted over UART at 57,600 baud, 1 stop bit, no parity, connecting a UART serial interface to the header and monitoring the output can confirm the vulnerability by observing PIN entries in the format '<key>,<x-coordinate>,<y-coordinate>'. There is no network-based detection because the data is not transmitted over the network but via the UART hardware interface. Suggested commands for detection include using a serial terminal program (e.g., `screen`, `minicom`, or `picocom`) on a Linux system to connect to the UART interface. For example: `screen /dev/ttyUSB0 57600` or `minicom -b 57600 -D /dev/ttyUSB0` where `/dev/ttyUSB0` is the serial device connected to the UART header. Observing the output for PIN press data confirms the vulnerability. Since the vulnerability requires physical access, network commands or scans will not detect it. The only remediation is hardware replacement as no firmware update or software patch exists. [2]