{"id":"CVE-2026-119746","kind":"vulnerability","aliases":["CVE-2026-119746"],"related":[],"title":"ProSoft ICX35 devices: login lockout bypass lets attackers guess passwords","description":"ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.","summary":"The account lockout on the ICX35 web login is enforced in client-side JavaScript, so deleting browser cookies resets it. A remote attacker can therefore keep guessing passwords without being locked out.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["icx35","industrial-devices","infrastructure","prosoft","web-login"],"not_affected_if":["isolated-network","no-remote-access"],"how_to_check":"- Check the firmware version on the ICX35 device (X35-HWC-A or ICX35-HWC-E) against the fixed version `1.14.158`","fix":"- ProSoft ICX35 (X35-HWC-A, ICX35-HWC-E): move to version `1.14.158`","status":"open","published_at":"2026-11-04T16:17:45+00:00","first_seen_at":"2026-11-04T16:28:10+00:00","triaged_at":"2026-11-04T16:28:49+00:00","updated_at":"2026-11-04T16:28:49+00:00","category":"infrastructure","confidence":0.7,"triage":{"at":"2026-11-04T16:28:49Z","model":"claude-haiku-5-5","output":{"fix":"- ProSoft ICX35 (X35-HWC-A, ICX35-HWC-E): move to version `1.14.158`","reach":"network","title":"ProSoft ICX35 devices: login lockout bypass lets attackers guess passwords","impact":"high","summary":"The account lockout on the ICX35 web login is enforced in client-side JavaScript, so deleting browser cookies resets it. A remote attacker can therefore keep guessing passwords without being locked out.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["prosoft","icx35","industrial-devices","web-login"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker guesses passwords without lockout and gains device access","analyst_note":"","how_to_check":"- Check the firmware version on the ICX35 device (X35-HWC-A or ICX35-HWC-E) against the fixed version `1.14.158`\n- unknown for other checks: the sources do not say","plain_action":"","needs_analyst":false,"not_affected_if":["isolated-network","no-remote-access"],"who_is_affected":"Any ICX35 device (X35-HWC-A or ICX35-HWC-E) whose web login is reachable by an attacker. The lockout that normally stops password guessing runs in the browser, so the flaw does not depend on any special setting. Teams that run these devices on isolated networks with no remote access face less exposure.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000693,"input_tokens":4223,"output_tokens":542,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119746':13A,16A '-2026':12A,15A '1.14.158':131C 'account':27B,83C 'address':128C 'attack':8A,49B,102C 'attempt':91C 'authent':90C 'browser':43B,116C 'brute':121C 'brute-forc':120C 'bypass':6A,75C 'client':38B,96C 'client-sid':37B,95C 'contain':71C 'continu':108C 'cooki':44B,117C 'cve':11A,14A 'defeat':118C 'delet':42B,113C 'devic':3A,20B,61C 'e':70C 'enforc':35B,93C 'fail':89C 'forc':122C 'guess':9A,53B,111C 'hwc':64C,69C 'icx35':2A,17B,31B,60C,68C 'icx35-hwc-e':67C 'industri':19B 'industrial-devic':18B 'infrastructur':21B 'integr':78C 'javascript':40B,98C 'keep':52B 'let':7A 'lock':57B 'lockout':5A,28B,74C,84C,106C 'login':4A,25B,33B,73C 'mechan':85C 'modul':79C 'page':81C 'password':10A,54B,110C 'prosoft':1A,22B,58C 'protect':123C 'relev':115C 'remot':48B,101C 'repeat':88C 'reset':45B,104C 'restrict':87C 'side':39B,97C 'submit':109C 'technolog':59C 'therefor':51B 'version':130C 'vulner':125C 'web':24B,32B,80C 'web-login':23B 'without':55B 'x35':63C 'x35-hwc-a':62C","nicknames":[],"mitigations":[],"who_affected":"Any ICX35 device (X35-HWC-A or ICX35-HWC-E) whose web login is reachable by an attacker. The lockout that normally stops password guessing runs in the browser, so the flaw does not depend on any special setting. Teams that run these devices on isolated networks with no remote access face less exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","icx35","industrialdevices","infrastructure","prosoft","weblogin"],"campaign_type":null,"first_public_at":"2026-11-04T16:17:45+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119746","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119746","severity":null,"published_at":"2026-11-04T16:17:45+00:00","modified_at":"2026-11-04T16:17:45+00:00","first_seen_at":"2026-11-04T16:28:10+00:00","fetched_at":"2026-11-04T16:28:10+00:00","note":null}],"documents":[{"id":68469,"url":"https://www.vulncheck.com/advisories/prosoft-icx35-login-lockout-bypass-via-client-side-cookies","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}