Dormakaba Access Manager Static Firmware Encryption Password Vulnerability

A vulnerability exists in the Dormakaba Access Manager due to a hardcoded password used to encrypt firmware updates. This password, embedded within the FWServiceTool application, can be extracted and is valid for multiple firmware versions. The encryption password is set in a DLL file, which can be accessed by disassembling the DLL with a tool like dnSpy.

Impact

Exploitation of this vulnerability allows for unauthorized access to the firmware encryption password, which can be used to decrypt and extract firmware updates intended for the Access Manager.

Reproduction

The vulnerability can be reproduced by disassembling the Dormakaba FWServiceTool DLL file named 'Firmware.Container.dll' using dnSpy. The extracted password can then be used to decrypt firmware ZIP files that are encrypted with this static password.

Remediation

Users are advised to contact their Dormakaba partner to ensure that their Access Manager is updated to a version that addresses this vulnerability.