# Belden ICX35 flaw bypasses login lockout

Published: 2026-10-28 · Severity: routine · Sectors: Manufacturing, Infrastructure · Not tied to an actor or CVE
Canonical: https://vorant.io/reports/0023d572-b8e3-5f5e-92fe-51a364c8f2f4/belden-icx35-flaw-bypasses-login-lockout
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> A CERT-FR advisory warns of a security bypass vulnerability in Belden ICX35-HWC switches that allows attackers to reset login lockout protections.

Source: cert.cyber.gouv.fr — https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1407

## What to check

- Applies to: Not tied to a specific actor, malware or CVE, only to the sectors it covers, so it may be general reporting. Check the source before acting on it. Whether it concerns you is not assessed.

CERT-FR issued an advisory describing a vulnerability affecting Belden ICX35-HWC-A and ICX35-HWC-E industrial networking products running firmware versions prior to 1.14.158. The flaw allows an attacker to bypass a security policy, specifically related to login lockout reset mechanisms as detailed in Belden's own PSIRT-9 security bulletin published October 28, 2026.

The vulnerability enables circumvention of account lockout protections, which could facilitate brute-force or repeated authentication attempts against the affected devices without triggering the intended lockout defenses. No in-the-wild exploitation is mentioned in the advisory.

Defenders operating Belden ICX35-HWC-A or ICX35-HWC-E devices should consult the vendor bulletin and update to firmware version 1.14.158 or later to remediate the issue. Organizations in sectors relying on Belden industrial networking equipment, such as manufacturing and infrastructure, should prioritize patching given the security-control bypass nature of the flaw.

Source reporting: https://www.cert.cyber.gouv.fr/avis/CERTFR-2026-AVI-1407

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0023d572-b8e3-5f5e-92fe-51a364c8f2f4/belden-icx35-flaw-bypasses-login-lockout.
The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup