Dozens of apartment buildings at risk due to a single default password

In a nutshell: Canadian security researcher Eric Daigle recently discovered a security deficiency associated with control panels used to restrict access to apartment buildings across the US and Canada. In short, some operators never bothered to change the system's default password, making it trivially easy to gain access, view activity logs, and more. Daigle started digging into the system late last year after noticing an interesting looking access control panel while out and about one day. A quick Google search for "MESH by Viscount" led to a sales page advertising remote access capabilities, and another search turned up a .PDF installation guide. As is somewhat common, the system ships with a default password that admins are encouraged to change (yet according to Daigle, the manual doesn't explain how to do so). Searching the UI's login page title surfaced several login pages, and he was able to log into the very first one using the default credentials. That is not a good sign. On ... Read full article.