Hirsch Enterphone MESH CVE-2025-26793

Internet-accessible mesh.webadmin.MESHAdminServlet endpoint with factory default credentials unchanged. No special configuration, user interaction, or authentication beyond the default credentials required. The vulnerability description explicitly identifies this affects systems where 'the administrator is not prompted to change these credentials on initial configuration' - meaning default deployment configurations are exploitable. Exploitation is LIMITED by network exposure: systems deployed with management interfaces restricted to internal/trusted networks only (proper network segmentation) are not remotely exploitable. Physical access control systems properly air-gapped or behind VPNs do not meet exploitation conditions despite vulnerable credentials. However, researcher findings demonstrate dozens of buildings deployed with Internet-exposed administrative interfaces, confirming insecure deployment is common practice.

This represents critical real-world risk despite absence from CISA KEV. The CVSS 4.0 score of 9.3 with network attack vector, no authentication required, and high confidentiality/integrity impact accurately reflects severity. EPSS probability of 27.21% (96th percentile) indicates attackers view this as a high-value target - significantly elevated compared to median CVE EPSS scores under 5%. The third-party researcher disclosure demonstrates practical exploitation against dozens of real apartment buildings, confirming this moves beyond theoretical risk. SSVC classification would be 'immediate action' based on: exploitation status is public (proof-of-concept demonstrated against live systems), automatable (simple credential authentication), and technical impact is total (full administrative control). The target environment compounds risk - physical security systems protecting residential buildings create safety implications beyond typical IT breaches. However, exploitation requires externally-exposed management interfaces; buildings that properly network-segment their access control systems or restrict management access to internal networks only face reduced risk. The vendor's position that operators should change defaults is technically valid but ignores human factors and product design responsibility.

An attacker performs Internet scanning for exposed Hirsch Enterphone MESH administrative interfaces, identifying buildings by characteristic mesh.webadmin.MESHAdminServlet endpoints. Using publicly-known default credentials 'freedom'/'viscount', the attacker authenticates to the web GUI without triggering alerts. Once authenticated, the attacker extracts resident PII (names, unit numbers, contact information) and potentially manipulates access control policies to grant unauthorized building entry or disable security features. Third-party research confirms this scenario successfully compromised dozens of real apartment buildings, demonstrating practical exploitability beyond proof-of-concept.