The firmware of the Comelit 1456B Multi‑User Gateway fails to apply server‑side authorization to the administrative password‑change function. A user with low privilege can invoke this function and overwrite the installer (administrator) account password, thereby gaining full administrative control. This is a classic privilege escalation weakness (CWE‑425) that would allow an attacker to modify configuration, install malicious code, or further compromise the network.

Affected versions are firmware 2.9.1 and 2.10.0 of the Comelit 1456B Multi‑User Gateway, a device produced by Comelit Group S.p.A. The vulnerability is present in the device’s built‑in management interface, specifically the password‑change endpoint used for the installer account.

The CVSS score of 8.8 indicates high severity. Although EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, the fact that the vendor will not ship a fix means the risk remains constant as long as the device remains network‑connected. The likely attack path involves an authenticated, low‑privilege user accessing the management interface over the local network; an attacker obtaining any valid account credential can then trigger the password overwrite. Consequently, internal attackers or compromised users pose a significant risk, while external exploitation is limited to scenarios where the attacker can reach the device’s management interface.