CVE-2025-26793

published 2025-02-15

CVE-2025-26793: The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom…

Priority P1 84 critical 9.3 CVSS 4.0

AV N AC L AT N PR N UI N VC H VI H VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S P AU X R X V X RE X U X

ITW EXPLOIT VulnCheck KEV

The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password."

Affected

1 ranges

Vendor	Product	Version range	Fixed in
hirsch	enterphone_mesh	<= 2024	—

Detection & IOCs extracted from sources · hover to see the quote

url /mesh/servlet/mesh.webadmin.MESHAdminServlet?requestedAction=login↗

path /mesh/servlet/mesh.webadmin.MESHAdminServlet↗

command formLoginName=freedom&formLoginPassword=viscount↗

other username: freedom, password: viscount↗

• → Detect exploitation attempts by monitoring POST requests to the MESHAdminServlet login endpoint with default credentials in the body. ↗
• → Successful login with default credentials will return a response body containing both 'Administration: Controlled Areas' and 'Log Out'. ↗
• → Use FOFA query 'title="FREEDOM Administration"' to identify exposed Enterphone MESH admin panels on the Internet. ↗
• → Content-Type header 'application/x-www-form-urlencoded' is used in the exploit POST request to the servlet. ↗

• · The vendor disputes the vulnerability, stating that affected systems are not following manufacturer recommendations to change the default password; no patch is implied. ↗
• · The administrator is never prompted to change default credentials during initial setup, increasing the likelihood of systems remaining vulnerable. ↗

CVSS provenance

nvd v4.0 9.3 CRITICAL CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X

vulncheck 10.0 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-1393