Remote Code Execution in dormakaba evolo Service

Executive Summary

This vulnerability affects the dormakaba evolo Service, a Windows-based .NET remoting application used for CardLink Updates with the dormakaba evolo Manager Access Control Solution. It allows unauthenticated remote attackers to execute arbitrary code as SYSTEM due to insecure deserialization of untrusted data (CWE-502). Exploitation requires prior network access and is only possible from within the internal network.

Useful 0 Not Useful 0

Detection Guidance

Check if the dormakaba evolo Service is installed and running on Windows systems. Look for the service named 'evolo Service' in the Services management console or via command line using 'sc query evoloService'. Inspect network traffic for connections to the service's default port, typically used by .NET remoting applications.

Useful 0 Not Useful 0

Impact Analysis

An attacker with network access could exploit this to run malicious code on your system with SYSTEM privileges, potentially taking full control of the machine. This could lead to data theft, system compromise, or disruption of access control services if the evolo Service is used in your environment.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. Organizations using the affected service may face compliance breaches, potential fines, and reputational damage if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Uninstall the dormakaba evolo Service if CardLink Update Terminals are not in use. If the service is required, isolate the machine in a protected network and apply strict firewall rules to block unnecessary incoming traffic. Ensure the service is not accessible from untrusted networks.

Useful 0 Not Useful 0