Description
ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ProSoft Technology | X35-HWC-A | ≤ 1.14.153 | 1.14.158 |
| ProSoft Technology | ICX35-HWC-E | ≤ 1.14.153 | 1.14.158 |
References
- Belden Security Advisory vendor-advisory patch
- VulnCheck Advisory: ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies third-party-advisory