Hotel door locks: from the 2012 Onity flaw to SALTO CVEs

At Black Hat Las Vegas in July 2012, researcher Cody Brocious showed that an Onity HT hotel door lock could be opened in seconds with a small electronic probe plugged into its service port. The technique fueled real burglaries in Texas and forced hotels worldwide into a hardware patch job. Fourteen years later, four CVEs published against SALTO ProAccess SPACE, an access-control software widely used in European hospitality, show that the physical layer of hotel security is still an afterthought.

2012: an unauthenticated service port

Onity's HT-series electromechanical locks, introduced in 1993, secured more than four million doors, by the figures presented at Black Hat. Each lock carries a port meant for the handheld programmer staff use to configure it. As Brocious demonstrated, communication over that port is unauthenticated and gives direct access to the lock's memory. From there, an attacker can open doors directly, create master keys, and even produce programming cards valid across an entire property, as ZDNet summarized from the disclosure paper.

The structural weakness was the "sitecode", an identifier shared by every lock on a property. The Unsaflok talk delivered at DEF CON 32 in 2024 confirms the design as it stood: the programming port allows reading lock memory, including the sitecode. One compromised key can therefore escalate into control of every door in the building.

Onity's answer: a cap and a screw

The vendor's first instinct was damage control. On July 25, 2012, the day after the demonstration, Onity said it considered the hacking method "unreliable and complex to implement" while promising a firmware upgrade. No CVE was ever assigned to the flaw. The fix that actually shipped was mechanical: a cap blocking the programmer port, backed by a security TORX screw on the battery cover. For a permanent remedy, Onity offered circuit-board replacement or new lock models, at hotel owners' cost.

Brocious himself put the installed base at an estimated ten million locks. That figure remains his estimate. Onity never confirmed the size of its fleet. The fleet documented by the BBC is in the millions of doors, which was already industrial scale.

Criminals picked it up quickly

The story left the hacker conference circuit fast. A string of burglaries in Texas hotels, including the Hyatt in Houston, was traced to the technique. Doors showed no forcing and no legitimate keycard in lock memory. A man, Matthew Allen Cook, was arrested and charged in the Hyatt break-in. That hotel hardened its doors by filling the port hole with glue. Other researchers refined the attack hardware: Matt Jakubowski of Trustwave SpiderLabs packed the exploit electronics into a whiteboard marker. Insurance brokers at the time expected to be "hit hard" as the method spread.

SALTO: same exposure, server side

The Onity chapter appeared to close with caps and swapped boards. Hotel access control then reproduced the same pattern one layer up. SALTO ProAccess SPACE 5.4.3.0, the console that manages networked locks and card production, carries four vulnerabilities published in public databases at the end of 2019: CVE-2019-19457 (cross-site scripting), CVE-2019-19458 (directory traversal in the Data Export feature), CVE-2019-19459 (arbitrary file write) and CVE-2019-19460 (incorrect default permissions).

The most serious mechanism chains the last two. The traversal reaches restricted locations, and the arbitrary file write lets an attacker drop content anywhere on the server, for example under the web root or in auto-start scripts, yielding execution of arbitrary commands on the access-control server. The fourth flaw amplifies everything: the ProAccess SPACE web server runs by default as a Windows service with local SYSTEM permissions, against the principle of least privilege. Owning that server, which holds the credentials and card-production data, amounts in practice to owning the doors it administers.

What operators should take from this

Two episodes seven years apart point at the same durable lessons. First, inventory lock generations: hotel estates typically mix old locks, improvised port caps and recent models, and Onity retrofits (cap or board swap) are rarely complete everywhere. Second, treat the access-control server as a sensitive system: network isolation, vendor patches applied, and the web service run with reduced privileges rather than SYSTEM.

Recent research keeps widening the perimeter. The Unsaflok DEF CON 32 presentation extends this lineage to dormakaba Saflok locks, installed on 3 million doors across 13,000 properties in 131 countries, and recalls a comparable VingCard episode fixed with ASSA ABLOY. A hotel room's security now lives at three layers: the lock, the software driving it, and the card joining them. Until all three are audited the way a payment server is, the service port of 2012 keeps paying.