Hirsch Enterphone MESH devices up to 2024 have a default credential issue (username 'freedom', password 'viscount') in their web GUI configuration panel. The lack of enforced credential change on initial configuration and the complicated process to update credentials enable remote attackers to access the administrative interface over the Internet. This access can lead to unauthorized retrieval of personally identifiable information (PII) of building residents. The vulnerability is identified as CWE-1393 (Use of Default Password) and has a CVSS 4.0 score of 10.0, indicating critical severity. No official patch or remediation guidance is currently provided by the vendor, who emphasizes that the root cause is failure to follow password change recommendations.

Successful exploitation allows unauthenticated remote attackers to gain administrative access to Hirsch Enterphone MESH devices, potentially compromising the privacy and security of residents by exposing their PII. The vulnerability affects multiple apartment buildings in Canada and the U.S. The CVSS score of 10.0 reflects the ease of exploitation and high impact on confidentiality and integrity. There are no known exploits in the wild at this time.

No official patch or fix is currently available. The vendor advises that affected systems must follow manufacturer recommendations to change default credentials immediately. Administrators should prioritize changing the default username and password despite the complexity of the process. Network-level controls such as restricting access to the management interface from untrusted networks can also reduce exposure.