CVE-2026-80276 in 1456B Multi-User Gateway
Summary
by MITRE • 10/01/2026
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the Remote Configuration Password - can be read in cleartext by a remote, unauthenticated attacker.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in Comelit Multi-User Gateway for VIP System models 1456B running firmware versions 2.9.1 and 2.10.0 represents a critical failure in access control mechanisms within the device's network management architecture. This flaw manifests as an unauthenticated, network-accessible interface that exposes sensitive configuration parameters to any remote actor capable of reaching the target system over the local area network or potentially through forwarded ports on wider networks if misconfigured firewalls are present. The core technical issue lies in the absence of mandatory authentication checks for specific administrative endpoints, allowing unauthorized entities to interact with the device's management subsystem without providing valid credentials. This design oversight effectively bypasses the intended security boundary, granting external observers direct read access to internal system states that should be strictly protected from public or untrusted network segments.
From a technical perspective, this vulnerability is classified under CWE-287, which denotes Improper Authentication, and more specifically aligns with CWE-359 regarding Exposure of Private Information Without Proper Access Control. The attacker exploits the lack of session validation on specific HTTP or API endpoints to retrieve plaintext configuration data. Among the most critical pieces of information exposed is the Remote Configuration Password. This credential serves as a master key for remote administrative tasks, meaning its exposure compromises not only the confidentiality of current settings but also the integrity and availability of the device in future interactions. The transmission of this password in cleartext further exacerbates the risk, as it can be captured via passive network sniffing or retrieved directly through active exploitation without needing to intercept encrypted traffic streams that might otherwise obscure such sensitive data during transit if proper TLS enforcement were correctly implemented across all management interfaces.
The operational impact of this vulnerability is severe and multifaceted. Initially, an attacker gains the ability to enumerate device configurations, which may include network settings, connected user details, and integration parameters with other security systems like video intercoms or access control panels. The disclosure of the Remote Configuration Password allows for a complete compromise of the gateway's administrative functions. An adversary can use this credential to log in as an administrator, modify system behavior, disable logging mechanisms, alter network routing rules, or potentially push malicious firmware updates if update verification processes are also weak. In the context of smart home and building automation systems, such a breach could lead to unauthorized physical access through compromised door locks or cameras, surveillance data theft via exposed video streams, and disruption of critical security services provided by the VIP system infrastructure.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary corrective action is for Comelit to release a firmware update that enforces strict authentication on all management interfaces, ensuring that no endpoint can be accessed without valid credentials. Until such an update is applied, administrators should isolate the gateway from untrusted networks by placing it behind robust firewall rules or within a dedicated VLAN with restricted access policies. Network segmentation limits the attack surface to only authorized administrative workstations, reducing the risk of remote exploitation over broader network segments. Additionally, enabling HTTPS for all management traffic and ensuring that sensitive configuration data is encrypted at rest rather than stored in cleartext would significantly reduce the impact if such an interface remains accessible. Security monitoring should also be enhanced to detect unusual access patterns or repeated failed login attempts associated with these endpoints, aligning detection efforts with MITRE ATT&CK techniques related to Initial Access and Credential Access.