The firmware of the Binardat 10G08-0800GSM network switch does not enforce a limit on failed login attempts or account lockout, allowing attackers to attempt unlimited brute‑force attacks against user credentials. This flaw can expose the switch’s administrative interface to credential compromise, leading to full control over network configuration and potentially broader network compromise. The weakness is classified as CWE‑307, reflecting insecure authentication practices that enable unauthorized access via brute force.

Vendors affected are Binardat Ltd. The 10G08‑0800GSM network switch, specifically firmware versions V300SP10260209 and earlier, is impacted. Users running these models are at risk if they rely on the default management interfaces (e.g., web, SSH, Telnet) for administration.

The CVSS v3.1 score of 6.9 indicates a moderate severity with potential confidentiality, integrity, and availability impact. The EPSS score is below 1%, suggesting low but non‑zero exploitation probability in the current landscape. The issue is not listed in CISA’s KEV, but the lack of rate limiting still permits brute‑force attacks over an exposed management interface, typically the network, and can be exploited remotely by attackers who can reach the switch’s management ports.