CVE-2025-26793 Hardcoded credentials in Enterphone MESH
Attackers can use default credentials to access the Web GUI of Hirsch Enterphone MESH systems, exposing resident PII and building controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-26793?
CVE-2025-26793 is a critical vulnerability in Hirsch Enterphone MESH, published on 15 Feb 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password."
Weakness: CWE-1393
Which versions are affected by CVE-2025-26793?
How do I fix CVE-2025-26793?
No fix has been published for CVE-2025-26793 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-26793 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-26793 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-x8v9-7r66-c92w.