CVE-2025-59106 identifies a critical security vulnerability in the dormakaba Access Manager 92xx-k7 product line, specifically versions earlier than BAME 06.00. The core issue is a violation of the least privilege principle (CWE-272), where the binary that serves the web interface and executes all commands initiated from the Web UI operates with root privileges. This architectural flaw means that if an attacker can exploit any other vulnerability to achieve code execution on the device, they can escalate their privileges to root without additional barriers. The vulnerability does not itself provide a direct remote code execution vector but significantly amplifies the impact of any other exploit by granting full system control. The Access Manager 92xx-k7 is a physical access control system widely used in enterprise and critical infrastructure environments to manage secure entry points. The lack of a CVSS score indicates this is a newly published vulnerability, and no public exploits have been observed yet. However, the potential for privilege escalation to root level makes this a serious concern. The vulnerability highlights poor security design in running a critical service with excessive privileges, increasing the attack surface and risk of complete system compromise if chained with other vulnerabilities. Dormakaba has not yet released a patch, and no mitigation links are available at this time.

For European organizations, the impact of this vulnerability can be significant, especially for those relying on dormakaba Access Manager 92xx-k7 for physical security management. Successful exploitation could allow attackers to gain root-level access to the device, enabling them to manipulate access control policies, disable alarms, create unauthorized access credentials, or disrupt physical security operations. This could lead to unauthorized physical access to sensitive facilities, data breaches, and operational disruptions. The vulnerability also increases the risk posed by other vulnerabilities, as it allows privilege escalation. Organizations in sectors such as government, finance, healthcare, and critical infrastructure are particularly at risk, as these sectors often deploy such access control systems and are attractive targets for attackers. The lack of known exploits currently reduces immediate risk but does not diminish the potential severity if combined with other vulnerabilities. Additionally, the root-level access could be leveraged to pivot into broader network environments, threatening confidentiality, integrity, and availability of enterprise systems.

1. Immediate mitigation should focus on network segmentation and isolation of dormakaba Access Manager devices to limit exposure to untrusted networks. 2. Implement strict access controls and monitoring on the management interfaces to detect and respond to suspicious activities promptly. 3. Employ host-based intrusion detection or endpoint protection solutions where possible to monitor for unauthorized command execution. 4. Regularly audit and harden the device configuration, disabling unnecessary services and interfaces to reduce attack surface. 5. Coordinate with dormakaba for timely updates and patches; prioritize deployment of the BAME 06.00 version or later once available. 6. Conduct penetration testing and vulnerability assessments on physical access control systems to identify and remediate other potential vulnerabilities that could be chained with this privilege escalation. 7. Maintain an incident response plan that includes scenarios involving physical security system compromise. 8. Consider compensating controls such as multi-factor authentication for administrative access to the device management interface.