Belden - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/belden/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 15:33:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgBelden ICX35: Security Policy Bypass Vulnerabilityhttps://feed.craftedsignal.io/briefs/2026-10-belden-icx35-bypass/Thu, 29 Oct 2026 15:33:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-belden-icx35-bypass/A security policy bypass vulnerability in Belden ICX35 industrial gateways allows attackers to reset login lockouts, circumventing authentication security controls.The French National Cybersecurity Agency (ANSSI) has published an advisory regarding a security vulnerability in Belden ICX35 industrial communication gateway products (models ICX35-HWC-A and ICX35-HWC-E). The vulnerability is identified in the vendor security bulletin "PSIRT-9-Login-Lockout-Resets-in-ICX35". It allows an unauthorized actor to bypass established security policies by resetting login lockout mechanisms. This could facilitate brute-force or credential-stuffing attacks against the device interface. No CVE identifier has been provided by the vendor at this time.

Impact

The vulnerability results in a bypass of the security policy governing authentication attempts. This potentially allows an attacker to maintain persistent brute-force attempts against the device, as the lockout mechanism intended to mitigate such activity can be reset.

Recommendation

  • Identify all instances of Belden ICX35-HWC-A and ICX35-HWC-E gateways within the OT environment.
  • Upgrade affected firmware to version 1.14.158 or later, as specified in the Belden PSIRT-9-Login-Lockout-Resets-in-ICX35 security bulletin.
  • Monitor authentication logs on industrial gateway management interfaces for repeated login failures followed by successful access or anomalous resets of lockout counters.
]]>highadvisoryvulnerabilityindustrial-control-systemsauthentication-bypass