Multiple critical flaws (20 CVEs!) in dormakaba physical access control system exos 9300 & access manager & registration unit (pin pad) allow attackers with network access to open arbitrary doors, reconfigure connected controllers and peripherals without prior authentication, and much more. Seems some systems are also reachable over the internet due to misconfigurations.

"According to the manufacturer, several thousand customers were affected, a small proportion of whom operate in environments with high security requirements" (critical infrastructure).