CVE-2024-29916
Medium
Description
The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property, aka the "Unsaflok" issue. This occurs, in part, because the key derivation function relies only on a UID. This affects, for example, Saflok MT, and the Confidant, Quantum, RT, and Saffire series.
SeverityMedium
CVSS5.6
Exploit probability—
ProductDormakaba Saflok Rt Firmware
PublishedMar 21, 2024
First seenMar 21, 2024
Weakness typeCWE-407CWE-407
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dormakaba saflok_rt_firmware | 0 | — |
| dormakaba saflok_mt_firmware | 0 | — |
| dormakaba quantum_firmware | 0 | — |
| dormakaba saffire_firmware | 0 | — |
| dormakaba confidant_firmware | 0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.