CVE-2026-105624
Received
Received - Intake
Account Lockout DoS in Zenitel Connect Web Interface
Vulnerability report for CVE-2026-105624, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-11-13
Last updated on: 2026-11-13
Assigner: cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e
Description
Description
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Zenitel | Zenitel Connect | From 0 (inc) to 1.11.0 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-645 | The product contains an account lockout protection mechanism, but the mechanism is too restrictive and can be triggered too easily, which allows attackers to deny service to legitimate users by causing their accounts to be locked out. |
