CVE-2024-58311 affects the Dormakaba Saflok System 6000 due to an improper finite state machine implementation in its hardware logic, specifically a predictable key generation algorithm. The system uses a 32-bit unique identifier to generate card access keys deterministically, enabling attackers to derive valid keys by applying a straightforward mathematical transformation to the identifier. This flaw compromises the confidentiality and integrity of the access control mechanism, potentially allowing unauthorized physical access. The vulnerability has a high CVSS 4.0 score of 8.7, reflecting its severity and ease of exploitation without privileges or user interaction. No patch or vendor advisory is currently available, and the affected product versions are unknown.

The vulnerability allows attackers to derive valid access keys from a card's unique identifier, potentially enabling unauthorized physical access to secured areas controlled by the Dormakaba Saflok System 6000. This compromises the security of the access control system, impacting confidentiality and physical security. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, organizations using Dormakaba Saflok System 6000 should monitor vendor communications for updates. Until a fix is provided, consider additional physical security controls or alternative access mechanisms to mitigate risk.