CVE-2026-119746highCWE-307CWE-602

CVE-2026-119746: high-severity vulnerability in ProSoft Technology X35-HWC-A

ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies

Published

Follow this CVE+ Monitor ICX35-HWC-E+ Monitor X35-HWC-A

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.2epss 0.4%
ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
ProSoft Technology · ICX35-HWC-EProSoft Technology · X35-HWC-A