1456B Multi User Gateway
Monthly
Any authenticated low-privilege user on a Comelit Multi-User Gateway for the VIP System (model 1456B) running firmware 2.9.1 or 2.10.0 can overwrite the installer (administrator) account password, because the administrative password-change function performs no server-side authorization check on the caller's role. The flaw is network-reachable with low complexity and no user interaction, but it is not fully unauthenticated: exploitation requires an existing 'user level' session, as reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Successfully resetting the installer credential hands the attacker full administrative control of the gateway and its managed access-control configuration; no public exploit code was identified at time of analysis, and no vendor-released patch was identified in the available intelligence at time of analysis.
The Comelit Multi-User Gateway for the VIP System (model 1456B) running firmware 2.9.1 or 2.10.0 exposes a network-reachable management interface that performs no authentication, allowing a remote attacker to read sensitive device configuration in cleartext - including the Remote Configuration Password. With CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), the exposure is fully remote, low-complexity and requires no credentials or user interaction; the only practical preconditions are network reachability to the interface and the device running an affected firmware build. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, so no exploitation-probability estimate is available.
Any authenticated low-privilege user on a Comelit Multi-User Gateway for the VIP System (model 1456B) running firmware 2.9.1 or 2.10.0 can overwrite the installer (administrator) account password, because the administrative password-change function performs no server-side authorization check on the caller's role. The flaw is network-reachable with low complexity and no user interaction, but it is not fully unauthenticated: exploitation requires an existing 'user level' session, as reflected in the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 High). Successfully resetting the installer credential hands the attacker full administrative control of the gateway and its managed access-control configuration; no public exploit code was identified at time of analysis, and no vendor-released patch was identified in the available intelligence at time of analysis.
The Comelit Multi-User Gateway for the VIP System (model 1456B) running firmware 2.9.1 or 2.10.0 exposes a network-reachable management interface that performs no authentication, allowing a remote attacker to read sensitive device configuration in cleartext - including the Remote Configuration Password. With CVSS 3.1 base 7.5 (AV:N/AC:L/PR:N/UI:N, C:H/I:N/A:N), the exposure is fully remote, low-complexity and requires no credentials or user interaction; the only practical preconditions are network reachability to the interface and the device running an affected firmware build. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided, so no exploitation-probability estimate is available.