CVE-2026-119746
ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.
| CWE | CWE-307 CWE-602 |
| Vendor | prosoft technology |
| Product | x35-hwc-a |
| Published | Nov 4, 2026 |
| Last Updated | Nov 4, 2026 |
Stay Ahead of the Next One
Get instant alerts for prosoft technology x35-hwc-a
Be the first to know when new medium vulnerabilities affecting prosoft technology x35-hwc-a are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
ProSoft Technology / X35-HWC-A
0 ≤ 1.14.153
ProSoft Technology / ICX35-HWC-E
0 ≤ 1.14.153
References
Credits
Rustam Amin