Description
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Zenitel | Zenitel Connect | < 1.11.0 | 1.11.0 |