Widespread Doorking Callbox Key Vulnerability

A member forwarded us this tweet about a widespread Doorking Callbox vulnerability, where doors/gates can be opened via default enclosure key and shorting lock contacts:

(2/2) The Answer: the Doorking callbox has a 'mail' keyswitch for postal workers. If you can open the callbox, you can easily short that switch gaining instant lobby access.

AND EVERY SINGLE DOORKING CALLBOX USES THE SAME MASTER KEY.

Which I bought on Amazon for $16.99 w/Prime. pic.twitter.com/PgSfqv6gw6

— Cabel (@cabel) February 18, 2021

The risk is the default enclosure key, a Doorking 16120 was used as factory default on thousands of callboxes and is inexpensive to buy, i.e. ~$7.00 from distributors and even less expensive off eBay. Doorking no longer uses this key code and changes it regularly for new callboxes, but presumably many sites are still using factory default keys.

Doorking installers have been told to replace factory 16120 key locks for many years, and replacement randomized keys/locks are inexpensive (i.e.: ~$12), but installers need to replace factory defaults (just like changing default passwords on network equipment).

This risk is not new and has been covered by many, including videos by Deviant Ollam that show just how easy it is to pull off:

We have reached out to Doorking tech support for recommendations to mitigate this risk.

Have you seen this problem in the field? How have you addressed it?