The author stumbled upon an apartment building with an intriguing access control panel from “MESH by Viscount” and decided to investigate further. Shockingly, default credentials gave access to sensitive information like residents’ full names, unit numbers, and even phone numbers. The ability to register new access fobs, disable existing ones, and unlock entrances easily was also discovered. A scan using ZoomEye revealed that a significant number of similar systems were vulnerable, with a majority of the exposed systems located in Canada. The timeline of events leading up to the discovery and efforts to alert clients were also detailed.
https://www.ericdaigle.ca/posts/breaking-into-dozens-of-apartments-in-five-minutes/