CVE-2026-105622: Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel
Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zenitel Connectto a version that resolves this vulnerability.Fixed in 1.11.0
Event History
Frequently Asked Questions
Which deployments are affected?
Zenitel Connect releases before 1.11.0 are affected if they expose or use the WAMP-CRA challenge-response authentication path. That authentication path is removed in version 1.11.0.
What does an attacker need to exploit this issue?
An attacker can attempt authentication remotely without prior privileges or user interaction. Practical exploitation depends on guessing a reused or predictable password, because affected releases require passwords of at least 12 characters with upper-case, lower-case, numeric, and special characters.
Is a brute-force attack limited by account lockout or rate limiting?
No. The affected WAMP-CRA path applies no account lockout or rate limiting, allowing unlimited authentication attempts against user accounts.
What is the available remediation?
Upgrade Zenitel Connect to version 1.11.0, where the WAMP-CRA authentication path has been removed. Until then, prioritize accounts whose passwords may be reused or predictable.