CVE-2025-25650

CVE-2025-25650 is a vulnerability in the storage of NFC card data within the Dorset DG 201 Digital Lock running firmware version H5_433WBSK_v2.2_220605. This flaw, linked to CWE-522 (Insufficiently Protected Credentials), enables attackers to produce cloned NFC cards that bypass the device's authentication mechanism. Published on 2025-03-17, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating critical severity due to high impacts on confidentiality and integrity.

Any remote attacker can exploit this vulnerability with low complexity, no required privileges, and no user interaction. By leveraging the insecure NFC card data storage, attackers can clone legitimate cards to gain unauthorized physical access through the digital lock, potentially compromising secured areas without affecting availability.

Mitigation guidance and further details are available in the primary security assessment report at https://github.com/AbhijithAJ/Dorset_SmartLock_Vulnerability/blob/main/Dorset_Smart_Lock_Security_Assessment_Report.pdf, alongside contextual resources on RFID cloning techniques from a 2013 Black Hat presentation (https://media.blackhat.com/us-13/US-13-Brown-RFID-Hacking-Live-Free-or-RFID-Hard-Slides.pdf) and a Kisi blog post (https://www.getkisi.com/blog/how-to-copy-access-cards-and-keyfobs).