Description
FREEDOM 是Hirsch的Web GUI 配置面板，由于更改凭据需要很多步骤，初始配置时不会提示管理员更改这些凭据，攻击者可以通过mesh.webadmin.MESHAdminServlet 在互联网上使用这些凭据，访问数十座加拿大和美国公寓楼并获取楼内居民的 PII。
FREEDOM Administration存在弱口令漏洞(CVE-2025-26793)
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.ddpoc.com/DVB-2025-8961.html
https://nvd.nist.gov/vuln/detail/CVE-2025-26793
https://cve.imfht.com/detail/CVE-2025-26793?lang=en
https://radar.offseq.com/threat/cve-2025-26793-cwe-1393-use-of-default-password-in-a8a618df
https://github.com/advisories/GHSA-x8v9-7r66-c92w
https://pentest-tools.com/vulnerabilities-exploits/freedom-administration-default-login_26850
https://www.sentinelone.com/vulnerability-database/cve-2025-26793/
https://go.hirschsecure.com/hubfs/Security%20Reporting/3-01-2025-Advisory-Notification-CVE-2025-26793.pdf
https://twit.tv/posts/tech/apartment-building-security-disaster-how-default-credentials-left-doors-wide-open
https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/