CVE-2025-26793: Hirsch Enterphone MESH Auth Bypass Flaw

CVE-2025-26793 Overview

CVE-2025-26793 is a critical hardcoded credentials vulnerability affecting the Hirsch (formerly Identiv and Viscount) Enterphone MESH Web GUI configuration panel. The system ships with default credentials (username freedom, password viscount) that are not required to be changed during initial setup. This insecure default configuration allows remote attackers to gain unauthorized administrative access to building access control systems via the Internet, potentially compromising physical security for dozens of residential buildings across Canada and the United States.

Critical Impact

Attackers can leverage default credentials to remotely access building entry systems, potentially unlocking doors, accessing resident personally identifiable information (PII), and compromising physical security of apartment buildings without any authentication bypass required.

Affected Products

• Hirsch Enterphone MESH (through 2024 versions)
• Identiv Enterphone MESH (legacy branding)
• Viscount Enterphone MESH (legacy branding)

Discovery Timeline

• 2025-02-15 - CVE-2025-26793 published to NVD
• 2025-02-24 - Last updated in NVD database

Technical Details for CVE-2025-26793

Vulnerability Analysis

This vulnerability represents a classic example of insecure default configuration (CWE-1393). The Enterphone MESH system is designed to manage physical access control for multi-tenant residential buildings, including intercom and door entry systems. The Web GUI configuration panel is exposed over the network and ships with well-known default credentials that remain unchanged in many production deployments.

The core issue lies in the product's initial setup workflow, which does not enforce credential changes. While vendors often argue that administrators should change default passwords, the multi-step process required to modify credentials creates friction that leads to widespread deployment of systems using factory defaults. The vulnerability is particularly severe because these access control systems are often Internet-accessible via the mesh.webadmin.MESHAdminServlet endpoint.

Root Cause

The root cause is the combination of hardcoded default credentials (freedom:viscount) and a poor user experience for credential management. The initial configuration process does not prompt administrators to set unique passwords, and the credential change process requires multiple steps, discouraging security best practices. This design flaw results in numerous production systems remaining configured with factory defaults.

Attack Vector

The attack vector is network-based and requires no user interaction or prior authentication. An attacker can scan for Internet-exposed Enterphone MESH systems and attempt authentication using the default credentials against the mesh.webadmin.MESHAdminServlet servlet endpoint.

Once authenticated, attackers gain administrative access to the building access control system, enabling them to:

• View and export resident PII including names, unit numbers, and contact information
• Unlock building entry doors remotely
• Modify access control policies
• Add unauthorized users to the system
• Disable security features

For detailed technical analysis of this vulnerability and its real-world impact, refer to the Eric Daigle Security Analysis which documents exploitation affecting dozens of apartment buildings.

Detection Methods for CVE-2025-26793

Indicators of Compromise

• Successful authentication attempts to the Enterphone MESH Web GUI using the freedom username
• Access to mesh.webadmin.MESHAdminServlet from unexpected IP addresses or geographic locations
• Bulk export or enumeration of resident data from the system
• Unauthorized modifications to door access policies or user accounts

Detection Strategies

• Monitor authentication logs for the Enterphone MESH system for logins using the default freedom username
• Implement network monitoring for HTTP/HTTPS traffic to Enterphone MESH administrative endpoints from external sources
• Deploy intrusion detection rules to alert on access attempts to /MESHAdminServlet paths
• Conduct periodic credential audits to identify systems still using default passwords

Monitoring Recommendations

• Implement centralized logging for all Enterphone MESH administrative access attempts
• Configure alerts for any administrative login events, particularly from non-whitelisted IP addresses
• Monitor for unusual patterns such as bulk data exports or rapid configuration changes
• Consider implementing geofencing to detect access from unexpected geographic regions

How to Mitigate CVE-2025-26793

Immediate Actions Required

• Change default credentials immediately on all Enterphone MESH installations
• Restrict network access to the administrative interface using firewall rules or VPN requirements
• Audit access logs for any unauthorized administrative sessions using the default credentials
• Conduct inventory of all deployed Enterphone MESH systems to ensure complete remediation coverage

Patch Information

The vendor (Hirsch/Identiv) has indicated that the systems are functioning as designed and that customers should follow manufacturer recommendations to change default passwords. Organizations should review the Identiv Physical Access Product support page for any firmware updates or security advisories.

As this is a configuration-based vulnerability rather than a code defect, mitigation requires manual credential changes by system administrators. Contact Hirsch/Identiv support for guidance on the credential change process if needed.

Workarounds

• Place Enterphone MESH systems behind a VPN or restrict administrative interface access to internal networks only
• Implement IP allowlisting to restrict administrative access to known management IP addresses
• Deploy a web application firewall (WAF) to monitor and restrict access to the MESHAdminServlet endpoint
• Consider network segmentation to isolate building access control systems from general corporate or Internet-facing networks
• Enable multi-factor authentication if supported by newer firmware versions

# Firewall rule example to restrict administrative access
# Restrict access to Enterphone MESH admin interface to management VLAN only
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP