Description
Hirsch（原Identiv和Viscount）Enterphone MESH 2024及之前版本的Web GUI配置面板使用默认凭据（用户名为freedom，密码为viscount）。在初始配置时，管理员不会被提示更改这些凭据，并且更改凭据需要很多步骤。
Hirsch Enterphone MESH Web GUI /mesh/jsp/login.jsp 默认口令漏洞（CVE-2025-26793）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-26793
https://go.hirschsecure.com/hubfs/Security%20Reporting/3-01-2025-Advisory-Notification-CVE-2025-26793.pdf
https://github.com/advisories/GHSA-x8v9-7r66-c92w
https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/
https://techcrunch.com/2025/02/24/a-single-default-password-exposes-access-to-dozens-of-apartment-buildings/
https://www.sentinelone.com/vulnerability-database/cve-2025-26793/
https://vuldb.com/vuln/295958
https://cve.imfht.com/detail/CVE-2025-26793?lang=en
https://pentest-tools.com/vulnerabilities-exploits/freedom-administration-default-login_26850