CVE-2026-105624: Zenitel Connect login allows account-lockout denial of service
The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zenitel Connectto a version that resolves this vulnerability.Fixed in 1.11.0
Event History
Frequently Asked Questions
Which users and functions are affected by the lockout condition?
Targeted Zenitel Connect user accounts can be temporarily locked out of the web interface. Intercom call handling is not affected.
What does an attacker need to trigger the denial of service?
An attacker can send repeated failed login requests using a known or guessed username. No authentication or user interaction is required.
Are deployments running version 1.11.0 affected?
The issue affects Zenitel Connect versions before 1.11.0. The provided information does not identify any other affected versions.
Can the disruption be sustained?
Yes. The temporary lockout can be repeated for as long as the attacker continues sending failed login attempts for the targeted account.