Authentication Bypass in Comelit Multi-User Gateway

Executive Summary

The Comelit Multi-User Gateway for VIP System (model 1456B) with firmware versions 2.9.1 and 2.10.0 has a flaw where it does not enforce proper authorization checks on an administrative password-change function. This allows an authenticated user with basic privileges to change the installer (administrator) account password, potentially gaining full control over the device.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if the Comelit Multi-User Gateway (model 1456B) is running firmware versions 2.9.1 or 2.10.0. Verify if an authenticated user can change the installer account password without proper authorization. Inspect network traffic for unauthorized administrative password-change requests targeting the gateway.

Useful 0 Not Useful 0

Impact Analysis

An attacker with access to the system could escalate their privileges to administrator level, allowing them to lock out legitimate users, disable security features, or manipulate the VIP system's video entry phone calls. This could compromise the security and privacy of the entire system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating privacy regulations like GDPR and HIPAA. If the VIP system handles personal or health data, the inability to enforce proper authorization may result in non-compliance with these standards, leading to legal and financial penalties.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Comelit Multi-User Gateway firmware to the latest version (2.10.1) to address the authorization flaw. Ensure only authorized users have access to administrative functions and monitor network traffic for unauthorized password-change attempts.

Useful 0 Not Useful 0