Belden ICX35: Security Policy Bypass Vulnerability

The French National Cybersecurity Agency (ANSSI) has published an advisory regarding a security vulnerability in Belden ICX35 industrial communication gateway products (models ICX35-HWC-A and ICX35-HWC-E). The vulnerability is identified in the vendor security bulletin "PSIRT-9-Login-Lockout-Resets-in-ICX35". It allows an unauthorized actor to bypass established security policies by resetting login lockout mechanisms. This could facilitate brute-force or credential-stuffing attacks against the device interface. No CVE identifier has been provided by the vendor at this time.

Impact

The vulnerability results in a bypass of the security policy governing authentication attempts. This potentially allows an attacker to maintain persistent brute-force attempts against the device, as the lockout mechanism intended to mitigate such activity can be reset.

Recommendation

• Identify all instances of Belden ICX35-HWC-A and ICX35-HWC-E gateways within the OT environment.
• Upgrade affected firmware to version 1.14.158 or later, as specified in the Belden PSIRT-9-Login-Lockout-Resets-in-ICX35 security bulletin.
• Monitor authentication logs on industrial gateway management interfaces for repeated login failures followed by successful access or anomalous resets of lockout counters.