Comelit 1456B Multi-User Gateway: Missing authorization in password change
Summary
The administrative password-change function of the Comelit 1456B Multi-User Gateway for the VIP door-entry system does not enforce authorization on the server side. Any authenticated user, including the lowest-level account, can overwrite the installer (administrator) password. An attacker with a valid low-privilege login on the network can thereby take over the installer account and lock out the legitimate installer, potentially gaining control over door access, call routing and connected cameras.
Affected
- Comelit 1456B Multi-User Gateway, firmware 2.9.1
- Comelit 1456B Multi-User Gateway, firmware 2.10.0
- Default configuration: unknown
Fixed in
- No fix confirmed for CVE-2026-80275.
- The vendor has stated it will not fix the issue and considers the behaviour intended.
- Firmware 2.10.1 (data 20260831) is listed on the vendor download page, but no release notes link it to this CVE. Verify with Comelit before treating it as a fix.
Workaround
- Treat every account on the device as administrator-equivalent.
- Restrict network access to the device management interface to trusted administrators only.
- Do not expose the management interface to the internet.
- Change default and shared credentials, including the installer password.
Exploitation
- CISA SSVC: exploitation none, automatable no.
- Not listed in CISA KEV.
- No public proof of concept is known.
Our recommendation
- Restrict network access to the gateway to trusted administrators and place it on its own network segment.
- Verify that the gateway is not reachable from the internet and that no port forwarding points to it.
- Replace default and shared passwords and review all user accounts on the device.
- Monitor the device for unexpected password changes or new user accounts.
- Ask Comelit whether firmware 2.10.1 addresses CVE-2026-80275 and CVE-2026-80276.
- Also address the companion vulnerability CVE-2026-80276, which is more severe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Comelit 1456B product page pro.comelitgroup.com
- accesscontrol.fail advisory accesscontrol.fail
- OpenCVE CVE-2026-80275 app.opencve.io
- VulDB CVE-2026-80275 vuldb.com
- Comelit firmware downloads pro.comelitgroup.com
- Comelit 1456B manual staticpro.comelitgroup.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:02.
Original description (NVD)
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.