The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
Upgrade to version 1.11.0
Workaround
No workaround given by the vendor.
References
History
Fri, 13 Nov 2026 15:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The login flow in Zenitel Connect before 1.11.0 applies per-account lockout on repeated failed login attempts, which allows remote attackers to cause a denial of service (temporary lockout of targeted user accounts from the web interface, repeatable for as long as the attack continues) via repeated failed login requests for a known or guessed username. Intercom call handling is not affected. | |
| Title | Zenitel Connect login allows account-lockout denial of service | |
| Weaknesses | CWE-645 | |
| References |
| |
| Metrics |
cvssV4_0
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Zenitel
Published:
Updated: 2026-11-13T15:41:59.393Z
Reserved: 2026-10-05T16:31:06.093Z
Link: CVE-2026-105624
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses