Instituto Nacional de ciberseguridad. Sección Incibe
Instituto Nacional de Ciberseguridad. Sección INCIBE-CERT

017 - Ir a la línea de ayuda en Ciberseguridad    Ir a Agenda     Ir a Sala de prensa     Ir a suscripción de boletines

Ir al buscador

Vulnerabilidades

Con el objetivo de informar, advertir y ayudar a los profesionales sobre las ultimas vulnerabilidades de seguridad en sistemas tecnológicos, ponemos a disposición de los usuarios interesados en esta información una base de datos con información en castellano sobre cada una de las ultimas vulnerabilidades documentadas y conocidas.

Este repositorio con más de 75.000 registros esta basado en la información de NVD (National Vulnerability Database) – en función de un acuerdo de colaboración – por el cual desde INCIBE realizamos la traducción al castellano de la información incluida. En ocasiones este listado mostrará vulnerabilidades que aún no han sido traducidas debido a que se recogen en el transcurso del tiempo en el que el equipo de INCIBE realiza el proceso de traducción.

Se emplea el estándar de nomenclatura de vulnerabilidades CVE (Common Vulnerabilities and Exposures), con el fin de facilitar el intercambio de información entre diferentes bases de datos y herramientas. Cada una de las vulnerabilidades recogidas enlaza a diversas fuentes de información así como a parches disponibles o soluciones aportadas por los fabricantes y desarrolladores. Es posible realizar búsquedas avanzadas teniendo la opción de seleccionar diferentes criterios como el tipo de vulnerabilidad, fabricante, tipo de impacto entre otros, con el fin de acortar los resultados.

Mediante suscripción RSS o Boletines podemos estar informados diariamente de las ultimas vulnerabilidades incorporadas al repositorio.

CVE-2026-24656
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** Deserialization of Untrusted Data vulnerability in Apache Karaf Decanter.<br /> <br /> <br /> The Decanter log socket collector exposes the port 4560, without authentication. If the collector exposes allowed classes property, this configuration can be bypassed.<br /> It means that the log socket collector is vulnerable to deserialization of untrusted data, eventually causing DoS.<br /> <br /> <br /> NB: Decanter log socket collector is not installed by default. Users who have not installed Decanter log socket are not impacted by this issue.<br /> <br /> This issue affects Apache Karaf Decanter before 2.12.0.<br /> <br /> Users are recommended to upgrade to version 2.12.0, which fixes the issue.
Gravedad CVSS v3.1: BAJA
Última modificación:
26/01/2026

CVE-2025-59103
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Access Manager 92xx in hardware revision K7 is based on Linux instead of Windows CE embedded in older hardware revisions. In this new hardware revision it was noticed that an SSH service is exposed on port 22. By analyzing the firmware of the devices, it was noticed that there are two users with hardcoded and weak passwords that can be used to access the devices via SSH. The passwords can be also guessed very easily. The password of at least one user is set to a random value after the first deployment, with the restriction that the password is only randomized if the configured date is prior to 2022. Therefore, under certain circumstances, the passwords are not randomized. For example, if the clock is never set on the device, the battery of the clock module has been changed, the Access Manager has been factory reset and has not received a time yet.
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
26/01/2026

CVE-2025-59104
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint (or use the 6-Pin tag-connect cable). Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through this vulnerability.
Gravedad CVSS v4.0: ALTA
Última modificación:
26/01/2026

CVE-2025-59105
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** With physical access to the device and enough time an attacker can desolder the flash memory, modify it and then reinstall it because of missing encryption. Thus, essential files, such as "/etc/passwd", as well as stored certificates, cryptographic keys, stored PINs and so on can be modified and read, in order to gain SSH root access on the Linux-based K7 model. On the Windows CE based K5 model, the password for the Access Manager can additionally be read in plain text from the stored SQLite database.
Gravedad CVSS v4.0: ALTA
Última modificación:
26/01/2026

CVE-2025-59106
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** The binary serving the web server and executing basically all actions launched from the Web UI is running with root privileges. This is against the least privilege principle. If an attacker is able to execute code on the system via other vulnerabilities it is possible to directly execute commands with highest privileges.
Gravedad: Pendiente de análisis
Última modificación:
26/01/2026

CVE-2025-59107
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** Dormakaba provides the software FWServiceTool to update the firmware version of the Access Managers via the network. The firmware in some instances is provided in an encrypted ZIP file. Within this tool, the password used to decrypt the ZIP and extract the firmware is set statically and can be extracted. This password was valid for multiple observed firmware versions.
Gravedad CVSS v4.0: ALTA
Última modificación:
26/01/2026

CVE-2025-59108
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** By default, the password for the Access Manager&amp;#39;s web interface, is set to &amp;#39;admin&amp;#39;. In the tested version changing the password was not enforced.
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
26/01/2026

CVE-2025-59109
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** The dormakaba registration units 9002 (PIN Pad Units) have an exposed UART header on the backside. The PIN pad is sending every button press to the UART interface. An attacker can use the interface to exfiltrate PINs. As the devices are explicitly built as Plug-and-Play to be easily replaced, an attacker is easily able to remove the device, install a hardware implant which connects to the UART and exfiltrates the data exposed via UART to another system (e.g. via WiFi).
Gravedad CVSS v4.0: MEDIA
Última modificación:
27/01/2026

CVE-2025-59096
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** The default password for the extended admin user mode in the application U9ExosAdmin.exe ("Kaba 9300 Administration") is hard-coded in multiple locations as well as documented in the locally stored user documentation.
Gravedad CVSS v4.0: MEDIA
Última modificación:
26/01/2026

CVE-2025-59097
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** The exos 9300 application can be used to configure Access Managers (e.g. 92xx, 9230 and 9290). The configuration is done in a graphical user interface on the dormakaba exos server. As soon as the save button is clicked in exos 9300, the whole configuration is sent to the selected Access Manager via SOAP. The SOAP request is sent without any prior authentication or authorization by default. Though authentication and authorization can be configured using IPsec for 92xx-K5 devices and mTLS for 92xx-K7 devices, it is not enabled by default and must therefore be activated with additional steps.<br /> <br /> This insecure default allows an attacker with network level access to completely control the whole environment. An attacker is for example easily able to conduct the following tasks without prior authentication:<br /> - Re-configure Access Managers (e.g. remove alarming system requirements)<br /> - Freely re-configure the inputs and outputs<br /> - Open all connected doors permanently<br /> - Open all doors for a defined time interval<br /> - Change the admin password<br /> - and many more<br /> <br /> Network level access can be gained due to an insufficient network segmentation as well as missing LAN firewalls. Devices with an insecure configuration have been identified to be directly exposed to the internet.
Gravedad CVSS v4.0: CRÍTICA
Última modificación:
26/01/2026

CVE-2025-59098
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Access Manager is offering a trace functionality to debug errors and issues with the device. The trace functionality is implemented as a simple TCP socket. A tool called TraceClient.exe, provided by dormakaba via the Access Manager web interface, is used to connect to the socket and receive debug information. The data is permanently broadcasted on the TCP socket. The socket can be accessed without any authentication or encryption. <br /> <br /> The transmitted data is based on the set verbosity level. The verbosity level can be set using the http(s) endpoint with the service interface password or with the guessable identifier of the device via the SOAP interface.<br /> <br /> The transmitted data contains sensitive data like the Card ID as well as all button presses on Registration units. This allows an attacker with network level access to retrieve all entered PINs on a registration unit.
Gravedad CVSS v4.0: ALTA
Última modificación:
26/01/2026

CVE-2025-59099
Fecha de publicación:
26/01/2026
Idioma:
Inglés
*** Pendiente de traducción *** The Access Manager is using the open source web server CompactWebServer written in C#. This web server is affected by a path traversal vulnerability, which allows an attacker to directly access files via simple GET requests without prior authentication. <br /> <br /> Hence, it is possible to retrieve all files stored on the file system, including the SQLite database Database.sq3, containing badge information and the corresponding PIN codes. Additionally, when trying to access certain files, the web server crashes and becomes unreachable for about 60 seconds. This can be abused to continuously send the request and cause denial of service.
Gravedad CVSS v4.0: ALTA
Última modificación:
26/01/2026
Suscribirse a Vulnerabilidades