CVE-2026-119746

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-119746", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-30T15:31:52.079Z", "datePublished": "2026-11-04T15:39:12.767Z", "dateUpdated": "2026-11-04T18:12:53.697Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T15:39:12.767Z"}, "title": "ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies", "descriptions": [{"lang": "en", "value": "ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158."}], "datePublic": "2026-10-28T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Restriction of Excessive Authentication Attempts", "cweId": "CWE-307", "type": "CWE"}, {"lang": "en", "description": "Client-Side Enforcement of Server-Side Security", "cweId": "CWE-602", "type": "CWE"}]}], "affected": [{"defaultStatus": "unaffected", "vendor": "ProSoft Technology", "product": "X35-HWC-A", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.14.153"}, {"status": "unaffected", "version": "1.14.158", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "vendor": "ProSoft Technology", "product": "ICX35-HWC-E", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.14.153"}, {"status": "unaffected", "version": "1.14.158", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "MEDIUM", "baseScore": 5.9, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "references": [{"url": "https://assets.belden.com/asset/3be80067-b211-423d-9be4-4e31bd43fbc9/PSIRT-9-Login-Lockout-Resets-in-ICX35.pdf", "name": "Belden Security Advisory", "tags": ["vendor-advisory", "patch"]}, {"url": "https://www.vulncheck.com/advisories/prosoft-icx35-login-lockout-bypass-via-client-side-cookies", "name": "VulnCheck Advisory: ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Rustam Amin", "type": "finder"}], "x_generator": {"engine": "vulncheck"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T18:12:42.577598Z", "id": "CVE-2026-119746", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T18:12:53.697Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-119746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T18:12:42.577598Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T18:12:49.092Z"}}], "cna": {"title": "ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies", "credits": [{"lang": "en", "type": "finder", "value": "Rustam Amin"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ProSoft Technology", "product": "X35-HWC-A", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.14.153"}, {"status": "unaffected", "version": "1.14.158", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "ProSoft Technology", "product": "ICX35-HWC-E", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.14.153"}, {"status": "unaffected", "version": "1.14.158", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2026-10-28T00:00:00.000Z", "references": [{"url": "https://assets.belden.com/asset/3be80067-b211-423d-9be4-4e31bd43fbc9/PSIRT-9-Login-Lockout-Resets-in-ICX35.pdf", "name": "Belden Security Advisory", "tags": ["vendor-advisory", "patch"]}, {"url": "https://www.vulncheck.com/advisories/prosoft-icx35-login-lockout-bypass-via-client-side-cookies", "name": "VulnCheck Advisory: ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-307", "description": "Improper Restriction of Excessive Authentication Attempts"}, {"lang": "en", "type": "CWE", "cweId": "CWE-602", "description": "Client-Side Enforcement of Server-Side Security"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T15:39:12.767Z"}}}, "cveMetadata": {"cveId": "CVE-2026-119746", "state": "PUBLISHED", "dateUpdated": "2026-11-04T18:12:53.697Z", "dateReserved": "2026-10-30T15:31:52.079Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-04T15:39:12.767Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "X35-HWC-A", "vendor": "ProSoft Technology", "versions": [{"lessThanOrEqual": "1.14.153", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.14.158", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "product": "ICX35-HWC-E", "vendor": "ProSoft Technology", "versions": [{"lessThanOrEqual": "1.14.153", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.14.158", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158."}], "id": "CVE-2026-119746", "lastModified": "2026-11-12T21:30:23.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-119746", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-04T18:12:42.577598Z", "version": "2.0.3"}}]}, "published": "2026-11-04T16:17:45.100", "references": [{"source": "disclosure@vulncheck.com", "url": "https://assets.belden.com/asset/3be80067-b211-423d-9be4-4e31bd43fbc9/PSIRT-9-Login-Lockout-Resets-in-ICX35.pdf"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/prosoft-icx35-login-lockout-bypass-via-client-side-cookies"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-307"}, {"lang": "en", "value": "CWE-602"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ICX35: ICX35: Account lockout bypass via client-side cookie manipulation", "id": "2567807", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567807"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.9", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-307", "details": ["ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.", "A flaw was found in ICX35. The integrated web interface enforces account lockout restrictions against repeated failed authentication attempts using client-side code rather than validating them on the server. A remote attacker can bypass this lockout protection by clearing browser cookies, enabling continuous brute-force password guessing to gain unauthorized access to the device."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-119746", "public_date": "2026-11-04T15:39:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-119746\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-119746\nhttps://assets.belden.com/asset/3be80067-b211-423d-9be4-4e31bd43fbc9/PSIRT-9-Login-Lockout-Resets-in-ICX35.pdf\nhttps://www.vulncheck.com/advisories/prosoft-icx35-login-lockout-bypass-via-client-side-cookies"], "statement": "This vulnerability is rated as Moderate because, while it allows an unauthenticated remote attacker to circumvent brute-force protections across the network, successful compromise still depends on guessing valid administrative credentials. The vulnerability resides exclusively in proprietary firmware for ProSoft Technology ICX35 cellular gateway devices. No Red Hat products package or ship this hardware-specific software, and Red Hat platforms are not impacted.", "threat_severity": "Moderate"}

{"created": "2026-11-04T17:00:18.052191+00:00", "updated": "2026-11-04T17:00:18.052206+00:00", "vendors": []}