CVE-2026-119746 PUBLISHED

ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies

Assigner: VulnCheck
Reserved: 30.10.2026 Published: 04.11.2026 Updated: 04.11.2026

ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 8.2

Product Status

Vendor ProSoft Technology
Product X35-HWC-A
Versions Default: unaffected
  • affected from 0 to 1.14.153 (incl.)
  • Version 1.14.158 is unaffected
Vendor ProSoft Technology
Product ICX35-HWC-E
Versions Default: unaffected
  • affected from 0 to 1.14.153 (incl.)
  • Version 1.14.158 is unaffected

Credits

  • Rustam Amin finder

References

Problem Types

  • Improper Restriction of Excessive Authentication Attempts CWE
  • Client-Side Enforcement of Server-Side Security CWE