{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/icx35-hwc-a--1.14.158/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["ICX35-HWC-A (\u003c 1.14.158)","ICX35-HWC-E (\u003c 1.14.158)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","industrial-control-systems","authentication-bypass"],"_cs_type":"advisory","_cs_vendors":["Belden"],"content_html":"\u003cp\u003eThe French National Cybersecurity Agency (ANSSI) has published an advisory regarding a security vulnerability in Belden ICX35 industrial communication gateway products (models ICX35-HWC-A and ICX35-HWC-E). The vulnerability is identified in the vendor security bulletin \u0026quot;PSIRT-9-Login-Lockout-Resets-in-ICX35\u0026quot;. It allows an unauthorized actor to bypass established security policies by resetting login lockout mechanisms. This could facilitate brute-force or credential-stuffing attacks against the device interface. No CVE identifier has been provided by the vendor at this time.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability results in a bypass of the security policy governing authentication attempts. This potentially allows an attacker to maintain persistent brute-force attempts against the device, as the lockout mechanism intended to mitigate such activity can be reset.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of Belden ICX35-HWC-A and ICX35-HWC-E gateways within the OT environment.\u003c/li\u003e\n\u003cli\u003eUpgrade affected firmware to version 1.14.158 or later, as specified in the Belden PSIRT-9-Login-Lockout-Resets-in-ICX35 security bulletin.\u003c/li\u003e\n\u003cli\u003eMonitor authentication logs on industrial gateway management interfaces for repeated login failures followed by successful access or anomalous resets of lockout counters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T15:33:07Z","date_published":"2026-10-29T15:33:07Z","id":"https://feed.craftedsignal.io/briefs/2026-10-belden-icx35-bypass/","summary":"A security policy bypass vulnerability in Belden ICX35 industrial gateways allows attackers to reset login lockouts, circumventing authentication security controls.","title":"Belden ICX35: Security Policy Bypass Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-10-belden-icx35-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - ICX35-HWC-a (\u003c 1.14.158)","version":"https://jsonfeed.org/version/1.1"}