Multiple critical vulnerabilities in dormakaba exos 9300 physical access control systems allow attackers with network access to open doors and reconfigure controllers without authentication. Some systems are exposed to the internet, and critical infrastructure may be affected.
Multiple critical flaws (20 CVEs!) in dormakaba physical access control system exos 9300 & access manager & registration unit (pin pad) allow attackers with network access to open arbitrary doors, reconfigure connected controllers and peripherals without prior authentication, and much more. Seems some systems are also reachable over the internet due to misconfigurations. "According to the manufacturer, several thousand customers were affected, a small proportion of whom operate in environments with high security requirements" (critical infrastructure). submitted by /u/0x9000 [link] [comments]