CVE-2025-26793

The web-based configuration panel for Hirsch Enterphone MESH (formerly Identiv and Viscount) versions through 2024 has a vulnerability due to default credentials. The username "freedom" with the password "viscount" can be used to access the administrative interface via `mesh.webadmin.MESHAdminServlet`. The system doesn't prompt administrators to change these credentials upon initial setup, and the process to change them is complex. This vulnerability potentially allows unauthorized access to building management systems. This vulnerability has been identified as CVE-2025-26793 and assigned the GitHub ID GHSA-x8v9-7r66-c92w. It affects numerous apartment buildings in Canada and the US. Exploiting this vulnerability could lead to unauthorized access and potential exposure of residents' personally identifiable information (PII). It's important to note that this information is current as of February 16, 2025, and the situation may evolve.