Comelit 1456B Gateway CVE-2026-80276

Exploitation requires network reachability to the 1456B Multi-User Gateway's management interface, which by design does not require authentication on firmware 2.9.1 and 2.10.0 - no credentials, user interaction, or special configuration are needed. The practical limiting factor is network exposure: the attacker must be able to route to the management interface (local network segment, or internet if the gateway is exposed/port-forwarded), and the device must be running one of the two affected firmware versions. There is no user-interaction or privilege barrier once the interface is reachable.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes the worst-case access profile: fully remote, low-complexity, unauthenticated, no user interaction - the device simply serves sensitive configuration without any authentication (CWE-306). I agree with the 7.5 and the confidentiality-only impact (C:H, I:N, A:N) for the direct effect, since the flaw reads data rather than altering it. However, the leaked item - the Remote Configuration Password - is itself a credential, so the practical downstream risk is higher than a pure information-disclosure score suggests: an attacker who harvests that password can likely proceed to authenticated reconfiguration of the gateway (an integrity impact that this base CVE does not capture). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The low-friction access profile (unauth, network-reachable, trivial complexity) makes this a genuine priority wherever the device is internet- or LAN-exposed, but the niche, industry-specific deployment footprint (building intercom/door-entry gateways) tempers the real-world urgency relative to the headline 7.5. Only two firmware versions (2.9.1, 2.10.0) are named and no fixed version is referenced, so patch availability is unconfirmed.

A remote attacker who can reach the 1456B gateway's management interface over the network sends an unauthenticated request and retrieves the device configuration, reading the Remote Configuration Password and other sensitive settings in cleartext. With that password, the attacker can then authenticate to the gateway's remote configuration channel and manipulate the VIP intercom/door-entry system. No public exploit code is identified at time of analysis, but the AC:L/PR:N/UI:N profile means exploitation requires only basic network access.