Doors, badges and key cards: access control is a computer

A door that depends on a box or a PC

In a recent building, the front door, the car-park gate and the cellar door open with a badge, a card or a code. Behind the reader sits a controller, often a small Linux server with a web interface; behind a hotel key card, a Windows workstation that encodes it. The question, for a co-ownership manager, a property manager or a company director, is a simple one: what happens on the day that machine is attacked? Four documented cases allow it to be answered without exaggeration or understatement: access controllers exploited on a large scale (Nortek eMerge E3), a hotel lock flaw used for burglary (Onity), ransomware that prevents key cards from being produced (Seehotel Jägerwirt) and a data breach that carries away lockbox codes (City Relay).

Nortek eMerge E3: door controllers exploited on a large scale (2019-2024)

Nortek’s Linear eMerge E3 is the box that decides whether a badge opens a door. It is also a web server. In April 2019, in Singapore, the researcher Gjoko Krstic, then at Applied Risk, presented ten vulnerabilities in this product, six of them critical; according to SecurityWeek, Nortek was the only manufacturer covered by his work to refuse any dialogue. On 12 November 2019, exploit code was published on Exploit-DB.

In early February 2020, SonicWall observed mass exploitation, reported by SecurityWeek on 3 February 2020: tens of thousands of attempts a day, a command that downloads and installs malicious software, then the use of the controller to launch denial-of-service attacks against third parties. More than 2,300 devices were exposed on the Internet at the time.

The main flaw, CVE-2019-7256, is an unauthenticated command injection through the web interface, rated 10.0 in the CISA advisory and 9.8 by the NVD. Hard-coded credentials (CVE-2019-7261 and CVE-2019-7265, 9.8) then open the way to full privileges. CISA advisory ICSA-24-065-01 lists twelve vulnerabilities in all, including an unrestricted file upload (CVE-2019-7257, 10.0).

What is striking is the timeline. CISA published an advisory on 2 July 2020 for a neighbouring model, the eMerge 50P/5000P, but the E3 series and CVE-2019-7256, although exploited since at least February 2020, had no advisory before 5 March 2024. On 25 March 2024, CISA added CVE-2019-7256 to its catalogue of exploited vulnerabilities. The manufacturer’s fix dates from 2023-2024, some five years after disclosure. In the meantime, the joint advisory from the FBI, the CNMF and the NSA of 18 September 2024 on the botnet known as ‘Raptor Train’, more than 260,000 devices in June 2024, lists CVE-2019-7256 among the flaws used, without quantifying the share of Nortek controllers. An FBI bulletin of 16 December 2024 reports scanning by the HiatusRAT campaign aimed at the same flaw, and on 8 October 2024 VulnCheck reported a new unauthenticated command injection, CVE-2024-9441 (9.8), with no fix available at that date.

No named public case has reported a malicious door opening or the erasure of logs by this route. The capability exists, since the attacker obtains full privileges; the observed use is denial of service against third parties. The doors keep working, and nothing tells the manager that their box is attacking someone else. The measures recommended by CISA are the classic ones: a firmware update, network isolation, a firewall, a VPN for remote access and a change of the factory credentials.

Onity locks: a conference flaw, burglaries two months later (2012)

In July 2012, at the Black Hat USA conference, Cody Brocious showed that a device cobbled together for around fifty dollars, plugged into the DC power port located under an Onity hotel lock, reads the lock’s memory, extracts the key from it and opens the door. Four million rooms were affected. On 17 August 2012, Onity announced two measures: a free plug and Torx screw to block the port, and a new circuit board at a special price, with shipping and labour remaining at the hotels’ expense, as The Register reported.

In September 2012, a series of burglaries hit the Hyatt House Galleria in Houston, operated by the franchisee White Lodging. On 31 October, police arrested Matthew Allen Cook, 27, after a stolen laptop turned up at a pawnbroker’s. Here, what the operator says must be separated from what the courts establish: White Lodging stated that it believed the rooms had been opened with the device exploiting the flaw, while the police, according to NBC News, left it to prosecutors to establish the method of entry.

The flaw has no CVE number: it is a hardware defect, stemming from weak cryptography and unprotected key data in the lock. The fix is therefore mechanical or hardware-based, not software: a physical intervention on each door. The Houston Hyatt posted security guards and sealed the ports with epoxy at the time, a stopgap rather than a correction. On 6 December 2012, Onity agreed to bear the cost of replacing the circuit boards for the large American chains, on locks installed after 2005. Four months after disclosure, the insurer Petra Risk Solutions indicated that a fifth of its clients had not yet dealt with the problem.

Seehotel Jägerwirt: the ransomware that prevents key cards from being produced (2016-2017)

The Romantik Seehotel Jägerwirt, on the Turracher Höhe in Austria, manages its rooms with key cards. The Windows workstation that encodes these cards also carries the reservation system and the till: a single machine for three vital functions. According to the ORF Kärnten report of 22 January 2017, the establishment suffered a first attack in the summer of 2016, with repairs costing several thousand euros that the insurer did not reimburse. The most serious came on the opening weekend of the 2016-2017 winter season: the key system, reservations and tills were blocked while the hotel was full, with 180 guests, and had just reopened after three weeks of closure without a recent backup of its data.

For a whole day, it was impossible to produce new cards for arriving guests. The manager, Christoph Brandstätter, paid two bitcoins, around 1,500 euros, and the systems were unlocked immediately. The initial infection vector was not published; staff were subsequently made aware of booby-trapped emails. No vulnerability identified by a CVE was involved.

A correction is called for. The ORF wrote that arriving guests could no longer get into their rooms, for want of cards; the English-language press hardened this into ‘guests locked in’. A week later, the manager clarified to BleepingComputer, which corrected its headline on 29 January 2017, that ‘nobody was locked in or out’: the locks open manually from the inside, in line with fire regulations, and the guests present barely noticed the incident.

Paying did not put an end to the attempts. On the night of 21 to 22 January 2017, a new attack was contained without a ransom, by taking the systems offline; the exact count of attacks varies from one source to another. The tally, as reported by the ORF and BleepingComputer: 1,500 euros of ransom paid once only, around 10,000 euros of security spending afterwards, nothing paid by the insurer for want of an identified perpetrator, and an announced return to mechanical keys at the next renovation. The remediation consisted of decoupling the systems, replacing the PCs, separating the networks, raising staff awareness and setting up tape backups not connected to the network.

City Relay: lockbox codes in a data breach (2026)

City Relay, a property manager in London and Paris, discovered on 8 September 2026 two unauthorised accesses to its Metabase Cloud instance, a reporting tool connected to its production databases. On 14 September, the company notified its partner property owners by email; The Register published on 17 September. The exposed data include names, email addresses, postal addresses, telephone numbers, account passwords, bank details (including IBANs and SWIFT references) as well as property access details and lockbox codes. The number of people affected has not been disclosed.

The link with a specific flaw remains, at this stage, a press hypothesis. On 6 August 2026, Metabase fixed an unauthenticated SQL injection, CVE-2026-72898, rated 10.0, documented in a GHSA security advisory and added to CISA’s catalogue of exploited vulnerabilities on 11 August; The Hacker News reported active exploitation as early as 8 August. In its account of 27 August, Metabase states that fewer than 3% of its cloud customers were compromised. The Register connects the two matters, but neither City Relay, which speaks of a platform vulnerability it was not aware of, nor Metabase has confirmed that link.

The response fits in one sentence: City Relay immediately had the affected access codes and lockbox codes changed. A lockbox code, a door entry code or a badge recorded in a database is a physical key; when the database leaks, the lock, or its code, has to be changed in every property concerned. On the regulatory side, the GDPR requires notification to the supervisory authority within 72 hours (Article 33) and information to the individuals concerned without undue delay (Article 34); six days between discovery and the email to customers do not in themselves constitute an infringement.

What this teaches a building or a co-owned property in Luxembourg

None of these four cases occurred in Luxembourg, and none concerns a co-owned property in the strict sense. The mechanisms, however, carry over to a badge-operated residence, an office building or a property manager who keeps lockbox codes in software. If you manage one of these, the steps that follow flow from the four cases.

• Take an inventory of the access control equipment: make, model, firmware version and, above all, what can be reached from the Internet. An exposed controller is attacked en masse, without anyone targeting your building.
• Take every door controller off the Internet and allow remote maintenance only over a VPN, behind a firewall. Waiting for an advisory from an authority is not enough: it took four years for the eMerge E3.
• Change the factory credentials at commissioning, and rule out any product whose credentials are hard-coded with no way of changing them.
• Segment: the doors network, the office network of the co-ownership manager or the caretaker and the residents’ network have no need to see one another.
• Do not let a single machine carry several vital functions: the PC that encodes the badges is not meant to be the accounting or email machine as well.
• Back up offline and test the restore before the incident. At Jägerwirt, it was the absence of a recent backup that led to the ransom.
• Plan the fallback mode: a mechanical master key, pre-encoded badges, and a check that every door opens from the inside without electricity or network, as was the case at Jägerwirt.
• Question the supplier before buying: how is the key protected in the lock, how are updates applied, how long is support provided? Onity is a reminder that a hardware flaw is fixed by an intervention on each door, to be budgeted for.
• Write the service contract: who accesses the controllers remotely and by which route, who follows the manufacturer’s security advisories, within what time a fix is applied, who keeps the logs.
• Treat codes as keys: a lockbox code or a door entry code stored in the manager’s software is changed after any incident, is not kept in clear text and is not passed on to a contractor who does not need it.
• Read the insurance policy before the incident: at Jägerwirt, the insurer paid nothing for want of an identified perpetrator.
• Prepare the notification: in the event of a personal data breach, the supervisory authority, in Luxembourg the CNPD, must be notified within 72 hours and the individuals concerned informed without undue delay.

None of these four cases relies on a technique beyond reach. A port under a lock, a web interface left on the Internet, a PC without backups, a reporting tool connected to the production database: these are organisational choices, which are corrected at the general meeting and in the contracts, calmly and ahead of any incident.

Sources

• CISA, advisory ICSA-24-065-01, Nortek Linear eMerge E3 (5 March 2024): cisa.gov
• CISA, addition of CVE-2019-7256 to the KEV catalogue (25 March 2024): cisa.gov
• SecurityWeek, exploitation observed by SonicWall (3 February 2020): securityweek.com
• SecurityWeek, late fix (12 March 2024): securityweek.com
• FBI, CNMF and NSA, joint advisory on the Raptor Train botnet (18 September 2024): ic3.gov
• VulnCheck, CVE-2024-9441 (8 October 2024): vulncheck.com
• FBI, HiatusRAT bulletin (16 December 2024): ic3.gov
• Exploit-DB 47619 (12 November 2019): exploit-db.com
• The Register, Onity locks (27 November 2012): theregister.com
• NBC News, Houston burglaries (27 November 2012): nbcnews.com
• ORF Kärnten, Seehotel Jägerwirt (22 January 2017): kaernten.orf.at
• BleepingComputer, Seehotel Jägerwirt (29 January 2017): bleepingcomputer.com
• The Register, City Relay (17 September 2026): theregister.com
• Metabase, account of the vulnerability (27 August 2026): metabase.com
• The Hacker News, Metabase flaw exploited (8 August 2026): thehackernews.com
• Advisory GHSA-vwf4-m7j8-wcjf, Metabase (6 August 2026): github.com