CVE-2026-119746 · Infrastructure
NO FIX YET · SEE WHAT TO DO
The account lockout on the ICX35 web login is enforced in client-side JavaScript, so deleting browser cookies resets it. A remote attacker can therefore keep guessing passwords without being locked out.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Any ICX35 device (X35-HWC-A or ICX35-HWC-E) whose web login is reachable by an attacker. The lockout that normally stops password guessing runs in the browser, so the flaw does not depend on any special setting. Teams that run these devices on isolated networks with no remote access face less exposure.
Not affected if isolated-network, no-remote-access
Who cares icx35, industrial-devices, prosoft, web-login
1.14.1581.14.158ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.
This page as .md · .json · in your agent: get_signal("CVE-2026-119746") · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.