Vulnerability · Published Oct 1, 2026 · Assigned by NCSC-FI
CVE-2026-80275Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint
High 8.8
In plain English
A high-severity security flaw in 1456B Multi-User Gateway from Comelit Group S.p.A.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 17% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.3%top 83.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an administrative password-change function. An authenticated user level can invoke this function to overwrite the installer (administrator) account password.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Comelit Group S.p.A. | 1456B Multi-User Gateway | 2.9.12.10.0 |
Weakness: CWE-425 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H