CVE-2026-119746
Description
A flaw was found in ICX35. The integrated web interface enforces account lockout restrictions against repeated failed authentication attempts using client-side code rather than validating them on the server. A remote attacker can bypass this lockout protection by clearing browser cookies, enabling continuous brute-force password guessing to gain unauthorized access to the device.
Statement
This vulnerability is rated as Moderate because, while it allows an unauthenticated remote attacker to circumvent brute-force protections across the network, successful compromise still depends on guessing valid administrative credentials. The vulnerability resides exclusively in proprietary firmware for ProSoft Technology ICX35 cellular gateway devices. No Red Hat products package or ship this hardware-specific software, and Red Hat platforms are not impacted.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
An attacker could perform an arbitrary number of authentication attempts using different passwords, and eventually gain access to the targeted account using a brute force attack.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
