CVE-2026-119746 in X35-HWC-A
Summary
by MITRE • 11/04/2026
ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/04/2026
The ProSoft Technology ICX35 devices, specifically models X35-HWC-A and ICX35-HWC-E, suffer from a critical authentication bypass flaw within their integrated module web interface. This vulnerability centers on the implementation of account lockout mechanisms designed to mitigate brute-force attacks against user credentials. The intended security control restricts access after a specified number of failed login attempts by locking the account for a predetermined duration or until an administrator intervenes. However, this protective measure is fundamentally compromised because it relies entirely on client-side JavaScript logic rather than server-side enforcement. This architectural decision creates a significant trust boundary violation where the integrity of the security control depends on the user's browser environment being unaltered and compliant with the application's expectations.
In practice, this technical flaw allows any remote attacker to circumvent the lockout restriction by manipulating local storage elements within their web browser. Specifically, an adversary can delete or modify specific cookies that track failed authentication attempts and current lockout status. By clearing these client-side indicators of failure, the attacker effectively resets the counter used for determining when a lockout should trigger. This enables the continuation of automated password guessing campaigns without interruption from the device's native defenses. The vulnerability is classified under CWE-640 as Weak Password Recovery Mechanism and aligns with MITRE ATT&CK technique T1110, which covers brute-force attacks against authentication systems.
The operational impact of this weakness is substantial for organizations relying on these industrial control devices for critical infrastructure or manufacturing processes. Since the ICX35 series often manages network connectivity in constrained environments, unauthorized access could lead to configuration changes, service disruption, or further exploitation through other vulnerabilities present in the device firmware. Attackers with basic web application knowledge can automate this cookie deletion process alongside password guessing scripts, rendering the default security controls ineffective against persistent threats. This lack of server-side validation means that even if an administrator sets strict lockout policies, they provide no actual protection unless enforced at the network or application layer outside the browser context.
To mitigate this risk, administrators must upgrade to version 1.14.158 or later where ProSoft Technology has addressed these issues by implementing server-side validation for account lockout states. Until such an update is applied, organizations should consider placing these devices behind a Web Application Firewall that can monitor and rate-limit authentication requests regardless of client behavior. Additionally, enforcing strong password policies and multi-factor authentication adds layers of defense that do not rely solely on the integrity of local browser storage. Regular auditing of device configurations and monitoring for unusual login patterns from external sources are also recommended to detect potential exploitation attempts early in the attack lifecycle.