CVE-2026-80275 Comelit Group S.p.A. CVE debrief

Who should care

Defenders responsible for Comelit Multi-User Gateway for VIP System (model 1456B) deployments, particularly those with firmware versions 2.9.1 and 2.10.0, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-80275 is a high-severity vulnerability in Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0, allowing authenticated users to change the installer account password due to insufficient authorization checks. Defenders should prioritize verifying exposure, updating access controls, and monitoring for potential unauthorized access.

• Potential unauthorized access to sensitive areas of the system.
• Possible elevation of privileges for authenticated users.
• Required verification of environment exposure and user account security.
• Need for updates to password management and access controls.

Technical summary

Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function, allowing an authenticated user to overwrite the installer (administrator) account password. This vulnerability has significant implications for system security, emphasizing the need for immediate verification and remediation efforts. The technical impact is substantial, as it enables potential unauthorized access and privilege escalation.

Defensive priority

Defenders should prioritize verifying exposure of Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0, and assess the need for password resets and updates.

Recommended defensive actions

• Verify exposure of Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 in the environment.
• Assess the need for password resets and updates for the installer (administrator) account.
• Review and update access controls for the administrative password-change function.
• Consider implementing additional monitoring for authentication and authorization events.
• Perform a thorough review of system logs to detect any potential unauthorized access.
• Implement compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions and retest remediated assets to ensure the vulnerability is fully resolved.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but vendor confirmation and additional impact information are limited. Defenders should verify exposure of Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0, assess the need for password resets and updates, and review access controls for the administrative password-change function. The evidence is grounded in official CVE and NVD sources, but further verification is recommended due to limited vendor confirmation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.