CVE-2026-119746
Received Received - Intake

Login Lockout Bypass in ProSoft Technology ICX35 Devices

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: VulnCheck

Description
ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-119746
EUVD
EUVD-2026-116968

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
ProSoft Technology X35-HWC-A 0
ProSoft Technology ICX35-HWC-E 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-307 The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame.
CWE-602 The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a login lockout bypass in ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E). The account lockout mechanism that prevents repeated failed login attempts is enforced in client-side JavaScript. A remote attacker can bypass this protection by deleting browser cookies, resetting the lockout state and allowing continued password guessing attempts.

Detection Guidance

To detect this vulnerability, check if your ProSoft Technology ICX35 devices (X35-HWC-A or ICX35-HWC-E) are running version 1.14.153 or earlier. Verify the firmware version via the device's web interface or CLI. If the version is vulnerable, the lockout bypass can be tested by attempting multiple failed logins and observing if deleting browser cookies resets the lockout counter.

Impact Analysis

An attacker could exploit this to repeatedly guess passwords without being locked out, potentially gaining unauthorized access to the device's web interface. This increases the risk of account compromise and unauthorized control of the ICX35 device.

Mitigation Strategies

Immediately upgrade affected ProSoft Technology ICX35 devices (X35-HWC-A or ICX35-HWC-E) to firmware version 1.14.158 or later. This patch addresses the client-side JavaScript lockout bypass. Until upgraded, avoid exposing the device's web interface to untrusted networks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-119746. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...