What is GHSA-g6fw-2m44-gprg?

GHSA-g6fw-2m44-gprg is a security advisory published by GitHub Security Advisories with High severity. ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in...

Which CVE IDs does GHSA-g6fw-2m44-gprg cover?

GHSA-g6fw-2m44-gprg covers the following CVE IDs: CVE-2026-119746. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-g6fw-2m44-gprg?

GHSA-g6fw-2m44-gprg has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

GHSA-g6fw-2m44-gprgHighCVSS 5.9

ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in...

Vendor

GitHub Security Advisories

Published

November 4, 2026

Last Modified

November 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-119746 →

📋 Description

ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account lockout mechanism that restricts repeated failed authentication attempts is enforced in client-side JavaScript, so a remote attacker can reset the lockout and continue submitting password guesses by deleting the relevant browser cookies, defeating the brute-force protection. This vulnerability has been addressed in version 1.14.158.

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2026-119746
https://assets.belden.com/asset/3be80067-b211-423d-9be4-4e31bd43fbc9/PSIRT-9-Login-Lockout-Resets-in-ICX35.pdf
https://www.vulncheck.com/advisories/prosoft-icx35-login-lockout-bypass-via-client-side-cookies
https://github.com/advisories/GHSA-g6fw-2m44-gprg