Vulnerability-Lookup

CVE-2025-26793 (GCVE-0-2025-26793)

Vulnerability from cvelistv5 – Published: 2025-02-15 00:00 – Updated: 2025-02-24 16:39

Shadowserver Previdian

Summary

The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents' PII. NOTE: the Supplier's perspective is that the "vulnerable systems are not following manufacturers' recommendations to change the default password."

Severity

10 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/MSI:S/S:P

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-19 14:16 UTC

CWE

CWE-1393 - Use of Default Password

Assigner

mitre mitre root

References

3 references

URL	Tags
https://support.identiv.com/products/physical-acc…
https://www.ericdaigle.ca/posts/breaking-into-doz…
https://news.ycombinator.com/item?id=43160884

Impacted products

1 product

Vendor	Product	Version	CPE status
Hirsch	Enterphone MESH	Affected: 0 , ≤ 2024 (custom)	guessed

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 2eb6ce5e-b62b-45d5-9f89-ab158c1e652b

Vulnerability ID: CVE-2025-26793

Status: Confirmed

Status Updated: 2026-07-14 00:00 UTC

Exploited: Yes

Characteristics

Severity: 0.0

Timestamps

First Seen: 2025-06-08

Asserted: 2025-06-08

Last Seen: 2026-07-14

Scope

Asset Exposure: ['internet-facing']

Evidence

Type: Honeypot

Signal: In The Wild Attempts

Confidence: 70%

Source: shadowserver

Details

1D	1
Iot	yes
Feed	Shadowserver Foundation honeypot/exploited-vulnerabilities
Type	http-scan
Class	other-software
7D Avg	0
Vendor	Hirsch
30D Avg	2
90D Avg	1
Product	Hirsch Enterphone MESH
Cisa Kev	no
Connections	6
Observation Date	2026-07-14
Vulnerability Class	CVSS
Vulnerability Score	0
Vulnerability Severity	None

References

Created: 2026-06-30 09:23 UTC | Updated: 2026-07-16 01:00 UTC

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

KEV entry ID: 69f136b0-50ff-47a8-9f98-9f0fb11baa5d

Vulnerability ID: CVE-2025-26793

Status: Confirmed

Status Updated: 2025-06-24 00:00 UTC

Exploited: Yes

Timestamps

First Seen: 2025-06-24

Asserted: 2025-06-24

Scope

Notes: KEVIntel entry: The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username... | Affected: Hirsch / Enterphone MESH | CVSS: 10.0 (CRITICAL) | Used in malware: unknown | Not yet in CISA KEV: True

Evidence

Type: Public Report

Signal: Successful Exploitation

Confidence: 70%

Source: kevintel

Details

Feed	KEVIntel (kevintel.com)
Title	The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username...
Vendor	Hirsch
Product	Enterphone MESH
Added Date	2025-06-24T00:00:00.000Z
Cvss Score	10.0
Epss Score	None
Cvss Severity	CRITICAL
Epss Percentile	None
Used In Malware	unknown
Ahead Of Cisa Kev	None
Not Yet In Cisa Kev	True

References

Created: 2026-06-23 14:03 UTC | Updated: 2026-07-10 06:14 UTC

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-26793",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-19T14:16:04.184219Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-19T14:16:09.209Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Enterphone MESH",
          "vendor": "Hirsch",
          "versions": [
            {
              "lessThanOrEqual": "2024",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents\u0027 PII. NOTE: the Supplier\u0027s perspective is that the \"vulnerable systems are not following manufacturers\u0027 recommendations to change the default password.\""
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 10,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/MSI:S/S:P",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1393",
              "description": "CWE-1393 Use of Default Password",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-24T16:39:41.829Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://support.identiv.com/products/physical-access/hirsch/"
        },
        {
          "url": "https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/"
        },
        {
          "url": "https://news.ycombinator.com/item?id=43160884"
        }
      ],
      "x_generator": {
        "engine": "enrichogram 0.0.1"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2025-26793",
    "datePublished": "2025-02-15T00:00:00.000Z",
    "dateReserved": "2025-02-14T00:00:00.000Z",
    "dateUpdated": "2025-02-24T16:39:41.829Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-26793",
      "date": "2026-09-17",
      "epss": "0.02416",
      "percentile": "0.83342"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-26793\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2025-02-15T15:15:23.587\",\"lastModified\":\"2026-06-17T09:02:26.767\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents\u0027 PII. NOTE: the Supplier\u0027s perspective is that the \\\"vulnerable systems are not following manufacturers\u0027 recommendations to change the default password.\\\"\"},{\"lang\":\"es\",\"value\":\"El panel de configuraci\u00f3n de la interfaz gr\u00e1fica de usuario web de Hirsch (anteriormente Identiv y Viscount) Enterphone MESH hasta 2024 se entrega con credenciales predeterminadas (nombre de usuario freedom, contrase\u00f1a viscond). No se le solicita al administrador que cambie estas credenciales en la configuraci\u00f3n inicial, y cambiar las credenciales requiere muchos pasos. Los atacantes pueden usar las credenciales a trav\u00e9s de Internet mediante mesh.webadmin.MESHAdminServlet para obtener acceso a docenas de edificios de apartamentos canadienses y estadounidenses y obtener informaci\u00f3n de identificaci\u00f3n personal de los residentes del edificio. NOTA: la perspectiva del proveedor es que los \\\"sistemas vulnerables no siguen las recomendaciones de los fabricantes para cambiar la contrase\u00f1a predeterminada\\\".\"}],\"affected\":[{\"source\":\"cve@mitre.org\",\"affectedData\":[{\"vendor\":\"Hirsch\",\"product\":\"Enterphone MESH\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"2024\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"cve@mitre.org\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":9.3,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"PRESENT\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-02-19T14:16:04.184219Z\",\"id\":\"CVE-2025-26793\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"cve@mitre.org\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-1393\"}]}],\"references\":[{\"url\":\"https://news.ycombinator.com/item?id=43160884\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://support.identiv.com/products/physical-access/hirsch/\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/\",\"source\":\"cve@mitre.org\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-05-28T17:22:18+00:00",
      "cve": "CVE-2025-26793",
      "id": "CVE-2025-26793",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "CVE-2025-26793",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-26793.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-26793\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-02-19T14:16:04.184219Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-02-18T17:00:37.941Z\"}}], \"cna\": {\"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 10, \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/MSI:S/S:P\"}}], \"affected\": [{\"vendor\": \"Hirsch\", \"product\": \"Enterphone MESH\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"2024\"}], \"defaultStatus\": \"unknown\"}], \"references\": [{\"url\": \"https://support.identiv.com/products/physical-access/hirsch/\"}, {\"url\": \"https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/\"}, {\"url\": \"https://news.ycombinator.com/item?id=43160884\"}], \"x_generator\": {\"engine\": \"enrichogram 0.0.1\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents\u0027 PII. NOTE: the Supplier\u0027s perspective is that the \\\"vulnerable systems are not following manufacturers\u0027 recommendations to change the default password.\\\"\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1393\", \"description\": \"CWE-1393 Use of Default Password\"}]}], \"providerMetadata\": {\"orgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"shortName\": \"mitre\", \"dateUpdated\": \"2025-02-24T16:39:41.829Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-26793\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-02-24T16:39:41.829Z\", \"dateReserved\": \"2025-02-14T00:00:00.000Z\", \"assignerOrgId\": \"8254265b-2729-46b6-b9e3-3dfca2d5bfca\", \"datePublished\": \"2025-02-15T00:00:00.000Z\", \"assignerShortName\": \"mitre\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-26793

Vulnerability from fkie_nvd - Published: 2025-02-15 15:15 - Updated: 2026-06-17 09:02

Shadowserver Previdian

Severity

9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/S:P

Summary

References

	URL	Tags
	cve@mitre.org	https://news.ycombinator.com/item?id=43160884
	cve@mitre.org	https://support.identiv.com/products/physical-access/hirsch/
	cve@mitre.org	https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unknown",
          "product": "Enterphone MESH",
          "vendor": "Hirsch",
          "versions": [
            {
              "lessThanOrEqual": "2024",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents\u0027 PII. NOTE: the Supplier\u0027s perspective is that the \"vulnerable systems are not following manufacturers\u0027 recommendations to change the default password.\""
    },
    {
      "lang": "es",
      "value": "El panel de configuraci\u00f3n de la interfaz gr\u00e1fica de usuario web de Hirsch (anteriormente Identiv y Viscount) Enterphone MESH hasta 2024 se entrega con credenciales predeterminadas (nombre de usuario freedom, contrase\u00f1a viscond). No se le solicita al administrador que cambie estas credenciales en la configuraci\u00f3n inicial, y cambiar las credenciales requiere muchos pasos. Los atacantes pueden usar las credenciales a trav\u00e9s de Internet mediante mesh.webadmin.MESHAdminServlet para obtener acceso a docenas de edificios de apartamentos canadienses y estadounidenses y obtener informaci\u00f3n de identificaci\u00f3n personal de los residentes del edificio. NOTA: la perspectiva del proveedor es que los \"sistemas vulnerables no siguen las recomendaciones de los fabricantes para cambiar la contrase\u00f1a predeterminada\"."
    }
  ],
  "id": "CVE-2025-26793",
  "lastModified": "2026-06-17T09:02:26.767",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "PRESENT",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "cve@mitre.org",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-26793",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-02-19T14:16:04.184219Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-02-15T15:15:23.587",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://news.ycombinator.com/item?id=43160884"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://support.identiv.com/products/physical-access/hirsch/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1393"
        }
      ],
      "source": "cve@mitre.org",
      "type": "Secondary"
    }
  ]
}

GHSA-X8V9-7R66-C92W

Vulnerability from github – Published: 2025-02-15 15:30 – Updated: 2025-02-24 18:32

Details

Severity

10.0 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/MSI:S/S:P

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-26793"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1393"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-02-15T15:15:23Z",
    "severity": "CRITICAL"
  },
  "details": "The Web GUI configuration panel of Hirsch (formerly Identiv and Viscount) Enterphone MESH through 2024 ships with default credentials (username freedom, password viscount). The administrator is not prompted to change these credentials on initial configuration, and changing the credentials requires many steps. Attackers can use the credentials over the Internet via mesh.webadmin.MESHAdminServlet to gain access to dozens of Canadian and U.S. apartment buildings and obtain building residents\u0027 PII. NOTE: the Supplier\u0027s perspective is that the \"vulnerable systems are not following manufacturers\u0027 recommendations to change the default password.\"",
  "id": "GHSA-x8v9-7r66-c92w",
  "modified": "2025-02-24T18:32:36Z",
  "published": "2025-02-15T15:30:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26793"
    },
    {
      "type": "WEB",
      "url": "https://news.ycombinator.com/item?id=43160884"
    },
    {
      "type": "WEB",
      "url": "https://support.identiv.com/products/physical-access/hirsch"
    },
    {
      "type": "WEB",
      "url": "https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:S/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-26793 (GCVE-0-2025-26793)

Shadowserver

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Characteristics

Timestamps

Scope

Evidence

Honeypot In The Wild Attempts Confidence: 70% Source: shadowserver

Details

References

Previdian

Known Exploited Vulnerability - GCVE BCP-07 Compliant

Timestamps

Scope

Evidence

Public Report Successful Exploitation Confidence: 70% Source: kevintel

Details

References

FKIE_CVE-2025-26793

GHSA-X8V9-7R66-C92W

Tags

Sightings

Nomenclature

Related by attack behaviour