CVE-2026-80275

13th percentile - higher than 13% of all known CVEs

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password.

An authenticated user with lower privileges can take over the administrator account, potentially leading to full compromise of the device and security system.

Update the device firmware to a version that properly enforces authorization for the password-change function. Restrict user privileges to the minimum necessary.