Login Lockout Bypass Vulnerability in ProSoft Technology ICX35 Devices

CVE-2026-119746

What is CVE-2026-119746?

ProSoft Technology's ICX35 devices, specifically the X35-HWC-A and ICX35-HWC-E models, exhibit a security weakness that allows remote attackers to bypass the login lockout mechanism. This flaw is due to the enforcement of the account lockout feature through client-side JavaScript. By deleting browser cookies, attackers can reset the lockout status and continue their unauthorized access attempts, undermining the brute-force protection measures in place. A patch addressing this vulnerability has been released in version 1.14.158. For further details, refer to the Belden Security Advisory and VulnCheck Advisory.

References