CVE-2026-80276

Summary

The Comelit Multi-User Gateway exposes an unauthenticated management interface that allows remote attackers to read sensitive configuration data including the Remote Configuration Password in cleartext. This authentication bypass flaw enables unauthorized access to device configuration without any credentials.

Exploitability

Exploitation is straightforward requiring only network access to the affected device, with no prerequisites beyond basic connectivity since the interface requires no authentication.

Blast radius

The impact could be significant as attackers could gain access to sensitive configuration data and potentially use the Remote Configuration Password to further compromise the system or gain administrative control over the VIP System gateway.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the unauthenticated management interface or restrict network access to port 80 to trusted sources until a firmware update is available, as no fixed version has been published in the description.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.