CVE-2026-105622
MEDIUM
MEDIUM
Priority: 0.00
BB Relevance:
73/100
Published: 2026-11-13
Modified: 2026-11-13
First seen: 2026-11-13
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
Low
VA:
Low
Description
Improper restriction of excessive authentication attempts in the WAMP-CRA (challenge-response) authentication path in Zenitel Connect before 1.11.0 allows remote attackers to guess user passwords via unlimited authentication attempts, because the path, in which the broker issues a challenge and the client returns an HMAC of it keyed with the user's secret, applies no account lockout or rate limiting. Affected releases enforce a password policy of at least 12 characters including upper-case, lower-case, numeric and special characters, so practical exploitation requires a reused or predictable password rather than exhaustive guessing. The WAMP-CRA authentication path is removed in 1.11.0.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| Zenitel | Zenitel Connect | 0 < 1.11.0 |