Archive — US — techcrunch
A single default password exposes access to dozens of apartment buildings
A security researcher revealed that dozens of residential and office buildings in the U.S. and Canada are vulnerable due to a default password in Hirsch's Enterphone MESH door access system. Hirsch refuses to fix the issue, arguing customers should change the default settings themselves, despite the system not prompting them to do so. This vulnerability poses risks for unauthorized access to buildings.
Key points
- Security researcher Eric Daigle discovered that Hirsch's Enterphone MESH system has a default password vulnerability.
- Hirsch has acknowledged the issue but refuses to offer a fix, citing it's the customers' responsibility to change the password.
- The vulnerability allows for easy access to door locks and elevator controls in 71 publicly accessible buildings.
- Default passwords are common in internet-connected devices, making them susceptible to exploitation.
- This vulnerability has been given a severity rating of 10/10 due to the simplicity of exploitation.
Why it matters
- There are ongoing governmental efforts to push manufacturers towards eliminating insecure default passwords from devices.
- The vulnerability highlights the broader trend of cybersecurity risks posed by poorly managed internet-of-things (IoT) devices.
- It reflects significant concerns in 2025 about cybersecurity implications related to user accountability and product design.
The exposed vulnerability in Hirsch's system serves as a critical reminder of the need for stronger security practices and user awareness, as failing to address legacy design issues can lead to significant risks for building occupants.