Comelit Multi-User Gateway EUVD-2026-90504

Requires a valid authenticated session at a non-administrative ('user level') account on a Comelit 1456B Multi-User Gateway running firmware 2.9.1 or 2.10.0, with network reachability to the device's management function. The limiting factor is that the attacker must already possess low-privilege credentials (PR:L) - it is not exploitable fully unauthenticated - but there is no user interaction, no non-default configuration, and no complexity barrier beyond that; the administrative password-change endpoint simply fails to enforce server-side authorization, so any authenticated user can call it against a default deployment.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High) describes a network-reachable, low-complexity flaw requiring only an existing authenticated low-privilege session and no user interaction - a plausible rating for a broken-authorization bug that lets any user overwrite the installer/administrator credential. Overwriting the admin password yields effective account takeover, which justifies the full C:H/I:H/A:H impact: the attacker gains administrative control (confidentiality), alters the credential (integrity), and can lock out the legitimate installer (availability). No EPSS score, CISA KEV listing, SSVC decision data, or public exploit was provided, so there is no public exploit identified at time of analysis and no evidence of active or automatable exploitation; this reads as a credible, high-impact but not-yet-weaponized post-authentication privilege-escalation issue rather than a mass-exploited internet threat. The single reference is only a vendor product page (not a security advisory), so affected-version and patch details rest on the NVD description alone. Note the CWE assignment (CWE-425 Direct Request/Forced Browsing) is a loose fit - the described defect is fundamentally a missing server-side authorization check (closer to CWE-862/CWE-285) on an administrative function.

An attacker who already holds any valid low-privilege account on a 1456B Multi-User Gateway (firmware 2.9.1 or 2.10.0) directly invokes the administrative password-change function over the network; because the server never checks that the caller is authorized, the request succeeds and overwrites the installer (administrator) account password. The attacker then logs in as the installer with the new credential, achieving full administrative takeover of the VIP intercom/door-entry gateway. No public proof-of-concept or exploit code was identified at time of analysis.