Single Default Password Puts Multiple Apartment Buildings at Risk: A Security Wake-Up Call
The recent discovery of a critical security vulnerability in the Enterphone MESH door access system has raised alarms about the safety of numerous buildings across the U.S. and Canada. This weak point allows unauthorized users to gain remote access to door locks and elevator controls, putting residents and businesses at risk.
Security Flaw in Enterphone MESH System
According to security researcher Eric Daigle, the default password that comes with the Enterphone MESH system makes it easy for anyone to access sensitive building controls. Unfortunately, the company that owns this system, Hirsch, has stated that they will not rectify this vulnerability, asserting that it is a design feature and that customers should have changed the default password during installation.
Vulnerability Details
Many buildings remain vulnerable because they either haven’t changed the default password or are unaware that they should. Daigle identified these exposed sites through an internet scanning tool, leading to the formal designation of the security issue as CVE-2025-26793.
- Default Password Risks: Default passwords are common in internet-connected devices and are often included in user manuals.
- Severity Rating: This specific vulnerability has been rated a perfect 10 on the severity scale due to its exploitability.
- Ease of Access: Accessing the system is as simple as using the default password found in the installation guide.
Impact of the Vulnerability
Daigle’s investigation revealed that the default password allows access to a web-based backend system used by building managers. This system controls elevators, common areas, and door locks, and even displays the physical addresses of affected buildings. This means that anyone with the default password could potentially break into these buildings within minutes.
Company Response and Industry Implications
While Hirsch has acknowledged the issue, their response has been less than reassuring. TechCrunch reached out to the company for comments, but CEO Mark Allen did not provide a direct response. Instead, a senior product manager referred to the use of default passwords as “outdated” without offering a plan for remediation.
Hirsch has indicated that they have informed their customers about the importance of following installation instructions. However, without a commitment to rectify this vulnerability, many buildings and their occupants remain at risk.
Importance of Changing Default Passwords
Default passwords pose a significant threat to security. Here are a few reasons why changing them is essential:
- Prevents unauthorized access to sensitive systems.
- Mitigates the risk of data breaches and cyberattacks.
- Enhances overall security posture for businesses and residents.
As governments and security experts push for better practices regarding default passwords, this incident highlights the necessity for technology manufacturers to prioritize user security over convenience.
For more information on how to secure your building’s access control systems, visit Cybersecurity.gov or learn about best practices for password management.
