A client‑side JavaScript check enforces the login lockout on ProSoft Technology ICX35 devices, meaning the lockout counter resides only in browser cookies. An attacker can clear those cookies to reset the counter, allowing repeated authentication attempts. This bypass eliminates the device’s brute‑force protection and permits an adversary to enumerate passwords until the correct one is discovered, resulting in unauthorized credential compromise. The vulnerability is available to any user who can reach the device’s web interface and does not rely on privilege escalation or exploit code execution.

ProSoft Technology ICX35-HWC-E and X35-HWC-A devices running firmware versions prior to 1.14.158 are affected. The fix was introduced in firmware 1.14.158 and later releases replace the client‑side lockout logic with a server‑side mechanism.

The CVSS score of 8.2 indicates high severity. Because the flaw requires only web‑UI access and a simple cookie delete, the EPSS score is not provided, but the inherent lack of mitigation suggests a high likelihood of exploitation in environments where the management console is reachable over the network. The vulnerability is not listed in the CISA KEV catalog, yet its impact on authentication security warrants immediate attention. Adversaries can easily use automated scripts to repeatedly delete cookies and submit credentials, effectively bypassing all local lockout protections.