{"id":"CVE-2026-105624","kind":"vulnerability","aliases":["CVE-2026-105624"],"related":[],"title":"Zenitel Connect: failed logins lock out user accounts from the web interface","description":"The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.","summary":"Zenitel Connect before 1.11.0 locks a user account after repeated failed logins. A remote attacker who knows or guesses a username can keep triggering that lockout and deny the real user web access.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["vendor","web-interface","zenitel-connect"],"not_affected_if":["intercom-only-use","version-1.11.0-or-later"],"how_to_check":"- Check the installed Zenitel Connect version in the web interface or product documentation; `unknown` if the sources do not give the exact location.\n- Look for any version below `1.11.0`.","fix":"- Zenitel Connect: `1.11.0` (the sources say versions before 1.11.0 are affected).","status":"open","published_at":"2026-11-13T16:17:23+00:00","first_seen_at":"2026-11-13T16:47:32+00:00","triaged_at":"2026-11-13T16:48:47+00:00","updated_at":"2026-11-13T16:48:47+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-13T16:48:47Z","model":"claude-haiku-5-5","output":{"fix":"- Zenitel Connect: `1.11.0` (the sources say versions before 1.11.0 are affected).","reach":"unknown","title":"Zenitel Connect: failed logins lock out user accounts from the web interface","impact":"low","summary":"Zenitel Connect before 1.11.0 locks a user account after repeated failed logins. A remote attacker who knows or guesses a username can keep triggering that lockout and deny the real user web access.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["zenitel-connect","web-interface"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Targeted user accounts are repeatedly locked out of the web interface.","analyst_note":"The only impact is denial of service through account lockout; sources do not say whether the web interface is exposed to the internet.","how_to_check":"- Check the installed Zenitel Connect version in the web interface or product documentation; `unknown` if the sources do not give the exact location.\n- Look for any version below `1.11.0`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["intercom-only-use","version-1.11.0-or-later"],"who_is_affected":"Teams that run Zenitel Connect with its web interface reachable by users or the network. The sources say Intercom call handling is not affected, so the risk is limited to web login and account lockout. unknown whether internet exposure is required.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000724,"input_tokens":4579,"output_tokens":532,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105624':15A,18A '-2026':14A,17A '1.11.0':29B,66C 'access':58B 'account':8A,33B,70C,92C 'affect':121C 'allow':78C 'appli':67C 'attack':40B,80C,103C 'attempt':76C 'call':117C 'caus':82C 'connect':2A,25B,27B,64C 'continu':104C 'cve':13A,16A 'deni':53B 'denial':84C 'fail':3A,36B,74C,107C 'flow':61C 'guess':44B,114C 'handl':118C 'intercom':116C 'interfac':12A,22B,96C 'keep':48B 'know':42B 'known':112C 'lock':5A,30B 'lockout':51B,71C,88C 'login':4A,37B,60C,75C,108C 'long':100C 'per':69C 'per-account':68C 'real':55B 'remot':39B,79C 'repeat':35B,73C,97C,106C 'request':109C 'servic':86C 'target':90C 'temporari':87C 'trigger':49B 'user':7A,32B,56B,91C 'usernam':46B,115C 'vendor':19B 'via':105C 'web':11A,21B,57B,95C 'web-interfac':20B 'zenitel':1A,24B,26B,63C 'zenitel-connect':23B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Zenitel Connect with its web interface reachable by users or the network. The sources say Intercom call handling is not affected, so the risk is limited to web login and account lockout. unknown whether internet exposure is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","vendor","webinterface","zenitelconnect"],"campaign_type":null,"search_a":"'-105624':15A,18A '-2026':14A,17A 'account':8A 'connect':2A 'cve':13A,16A 'fail':3A 'interfac':12A 'lock':5A 'login':4A 'user':7A 'web':11A 'zenitel':1A","search_b":"'1.11.0':29B 'access':58B 'account':33B 'attack':40B 'connect':25B,27B 'deni':53B 'fail':36B 'guess':44B 'interfac':22B 'keep':48B 'know':42B 'lock':30B 'lockout':51B 'login':37B 'real':55B 'remot':39B 'repeat':35B 'trigger':49B 'user':32B,56B 'usernam':46B 'vendor':19B 'web':21B,57B 'web-interfac':20B 'zenitel':24B,26B 'zenitel-connect':23B","search_c":"'1.11.0':66C 'account':70C,92C 'affect':121C 'allow':78C 'appli':67C 'attack':80C,103C 'attempt':76C 'call':117C 'caus':82C 'connect':64C 'continu':104C 'denial':84C 'fail':74C,107C 'flow':61C 'guess':114C 'handl':118C 'intercom':116C 'interfac':96C 'known':112C 'lockout':71C,88C 'login':60C,75C,108C 'long':100C 'per':69C 'per-account':68C 'remot':79C 'repeat':73C,97C,106C 'request':109C 'servic':86C 'target':90C 'temporari':87C 'user':91C 'usernam':115C 'via':105C 'web':95C 'zenitel':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T16:17:23+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cf9c5165-6fe5-4ec0-b5f1-404f1df30a4e","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105624","severity":null,"published_at":"2026-11-13T16:17:23+00:00","modified_at":"2026-11-13T16:17:23+00:00","first_seen_at":"2026-11-13T16:47:32+00:00","fetched_at":"2026-11-13T16:47:32+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}