CVE-2026-80276
Received Received - Intake

Authentication Bypass in Comelit Multi-User Gateway

Publication date: 2026-10-01

Last updated on: 2026-10-01

Assigner: National Cyber Security Centre Finland

Description
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface that does not require authentication. Through this interface, sensitive device configuration data - including the Remote Configuration Password - can be read in cleartext by a remote, unauthenticated attacker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-01
Last Modified
2026-10-01
Generated
2026-10-01
AI Q&A
2026-10-01
EPSS Evaluated
N/A
NVD
CVE-2026-80276
EUVD
EUVD-2026-90503

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
comelit multi_user_gateway 2.9.1
comelit multi_user_gateway 2.10.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Comelit Multi-User Gateway for VIP System (model 1456B) has a network-accessible management interface that lacks authentication requirements. This allows remote attackers to access sensitive device configuration data, including the Remote Configuration Password, in cleartext without any prior authentication.

Detection Guidance

Scan your network for devices running Comelit Multi-User Gateway firmware versions 2.9.1 or 2.10.0. Use tools like nmap to identify open ports and services. Check for unauthenticated access to management interfaces on these devices.

Impact Analysis

An unauthenticated attacker could exploit this to read sensitive configuration data, potentially gaining control over the device or accessing protected network resources. This could lead to unauthorized access, data breaches, or further attacks on connected systems.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and encryption for sensitive data, such as GDPR (data protection) and HIPAA (health information privacy). Unauthorized access risks non-compliance and potential legal penalties.

Mitigation Strategies

Immediately update the firmware to a patched version if available. Disable remote access to the management interface if not required. Implement network segmentation to isolate these devices from critical systems.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80276. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart