CVE-2026-80275 (GCVE-0-2026-80275)

Vulnerability from cvelistv5 – Published: 2026-10-01 05:51 – Updated: 2026-10-01 05:51
VLAI
Title
Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint
Summary
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-425 - Direct Request ('Forced Browsing')
Assigner
References
Impacted products
Vendor Product Version CPE status
Comelit Group S.p.A. 1456B Multi-User Gateway Affected: 2.9.1
Affected: 2.10.0
guessed Create a notification for this product.
Credits
Teemu Tapanila Juha Jussila
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Firmware"
          ],
          "product": "1456B Multi-User Gateway",
          "vendor": "Comelit Group S.p.A.",
          "versions": [
            {
              "status": "affected",
              "version": "2.9.1"
            },
            {
              "status": "affected",
              "version": "2.10.0"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Teemu Tapanila"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Juha Jussila"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eComelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password.\u003c/p\u003e"
            }
          ],
          "value": "Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-87",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-87 Forceful Browsing"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-425",
              "description": "CWE-425 Direct Request (\u0027Forced Browsing\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-01T05:51:37.479Z",
        "orgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
        "shortName": "NCSC-FI"
      },
      "references": [
        {
          "name": "Comelit 1456B product page",
          "tags": [
            "product"
          ],
          "url": "https://pro.comelitgroup.com/en-us/product/1456B"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-03-22T00:00:00.000Z",
          "value": "Vulnerability discovered during web endpoint authorization testing and reported to Comelit"
        },
        {
          "lang": "en",
          "time": "2026-03-30T00:00:00.000Z",
          "value": "Comelit acknowledged receipt and assigned vendor tracking ID VMP-40"
        },
        {
          "lang": "en",
          "time": "2026-04-10T00:00:00.000Z",
          "value": "Comelit declined to remediate, classifying the behavior as intended; finder contested this classification as a breach of privilege separation"
        },
        {
          "lang": "en",
          "time": "2026-06-06T00:00:00.000Z",
          "value": "Coordinated disclosure filed with NCSC-FI (Traficom) requesting vendor coordination"
        }
      ],
      "title": "Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe vendor does not consider this a defect and has stated it will not be fixed, so the device\u0027s built-in role separation cannot be relied upon. As a mitigation, treat every account on the device as an administrator-equivalent account. Additionally, restrict network access to the device management interface to trusted administrators only.\u003c/p\u003e"
            }
          ],
          "value": "The vendor does not consider this a defect and has stated it will not be fixed, so the device\u0027s built-in role separation cannot be relied upon. As a mitigation, treat every account on the device as an administrator-equivalent account. Additionally, restrict network access to the device management interface to trusted administrators only."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
    "assignerShortName": "NCSC-FI",
    "cveId": "CVE-2026-80275",
    "datePublished": "2026-10-01T05:51:37.479Z",
    "dateReserved": "2026-08-26T07:24:58.118Z",
    "dateUpdated": "2026-10-01T05:51:37.479Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "platforms": [
                  "Firmware"
                ],
                "product": "1456B Multi-User Gateway",
                "vendor": "Comelit Group S.p.A.",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.9.1"
                  },
                  {
                    "status": "affected",
                    "version": "2.10.0"
                  }
                ]
              }
            ],
            "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password."
          }
        ],
        "id": "CVE-2026-80275",
        "lastModified": "2026-10-01T06:17:09.720",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-01T06:17:09.720",
        "references": [
          {
            "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
            "url": "https://pro.comelitgroup.com/en-us/product/1456B"
          }
        ],
        "sourceIdentifier": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
        "vulnStatus": "Received",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-425"
              }
            ],
            "source": "db4dfee8-a97e-4877-bfae-eba6d14a2166",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.