CVE-2026-119746: ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies

Published Nov 4, 2026

Updated

ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ProSoft Technology ICX35 to a version that resolves this vulnerability.
Fixed in 1.14.158

Event History

Nov 4, 2026

CVE Published

via MITRE·03:39 PM

Data Sourced

via MITRE·03:39 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which devices are affected?

The affected products are ProSoft Technology ICX35 devices, specifically models X35-HWC-A and ICX35-HWC-E.

What does an attacker need to exploit this issue?

An unauthenticated remote attacker needs access to the integrated module web page and the ability to submit repeated password guesses. They can delete the browser cookies used by the client-side lockout logic to reset the lockout between attempts.

Are devices running version 1.14.158 affected?

The issue has been addressed in version 1.14.158. Devices should be updated to that version to remediate the vulnerability.

CVE-2026-119746: ProSoft ICX35 Login Lockout Bypass via Client-Side Cookies

Remediation

Event History

Frequently Asked Questions

Which devices are affected?

What does an attacker need to exploit this issue?

Are devices running version 1.14.158 affected?

Company

Resources

Contact

Frequently Asked Questions

Which devices are affected?

What does an attacker need to exploit this issue?

Are devices running version 1.14.158 affected?