dormakaba Access Manager 9200-K7 Weak Default Passwords for SSH Access Vulnerability

A vulnerability exists in the dormakaba Access Manager 9200-K7 due to weak default passwords for SSH access. The root password is initially set to 'eac', and the 'update_user' account has a default password of 'secret'. Under certain conditions, the root password is not randomized and remains as 'eac', allowing unauthorized access via SSH. This issue affects all versions of the Access Manager 9200-K7 prior to BAME 05.01.088.

Impact

Exploitation of this vulnerability allows for unauthorized SSH access to the Access Manager 9200-K7 with root privileges.

Reproduction

The vulnerability can be reproduced by attempting to log into the Access Manager 9200-K7 via SSH using the default 'root' password 'eac', or the 'update_user' account with the password 'secret', if the password has not been changed after the first deployment.

Remediation

Users are advised to update to Access Manager 9200-K7 version BAME 05.01.088 or later, where this vulnerability has been addressed.