CVE-2026-5794 - Vulnerability Details - OpenCVE

A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Ercom	Cryptobox

No data.

No data.

References

Link	Providers
https://info.cryptobox.com/doc/v4.40/4.40.en/

History

Wed, 29 Apr 2026 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 29 Apr 2026 14:45:00 +0000

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:ercom:cryptobox:::::::: cpe:2.3:a:ercom:cryptobox:4.40.175:::::::*

Tue, 28 Apr 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.
Title		Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout
First Time appeared		Ercom Ercom cryptobox
Weaknesses		CWE-694
CPEs		cpe:2.3:a:ercom:cryptobox:::::::: cpe:2.3:a:ercom:cryptobox:4.40.175:::::::*
Vendors & Products		Ercom Ercom cryptobox
References		https://info.cryptobox.com/doc/v4.40/4.40.en/
Metrics		cvssV4_0 `{'score': 4.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U'}`

MITRE

Status: PUBLISHED

Assigner: THA-PSIRT

Published: 2026-04-28T17:09:55.609Z

Updated: 2026-04-29T14:06:08.155Z

Reserved: 2026-04-08T13:20:07.168Z

Link: CVE-2026-5794

Vulnrichment

Updated: 2026-04-28T18:33:53.379Z

NVD

Status : Awaiting Analysis

Published: 2026-04-28T19:37:47.390

Modified: 2026-04-28T20:10:23.367

Link: CVE-2026-5794

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-5794", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "state": "PUBLISHED", "assignerShortName": "THA-PSIRT", "dateReserved": "2026-04-08T13:20:07.168Z", "datePublished": "2026-04-28T17:09:55.609Z", "dateUpdated": "2026-04-29T14:06:08.155Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-04-29T14:06:08.155Z"}, "title": "Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout", "datePublic": "2026-04-29T14:04:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-694", "description": "CWE-694 Use of multiple resources with duplicate identifier", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-2", "descriptions": [{"lang": "en", "value": "CAPEC-2 Inducing Account Lockout"}]}], "affected": [{"vendor": "Ercom", "product": "Cryptobox", "modules": ["Cryptobox server"], "versions": [{"status": "unaffected", "version": "4.40.175"}, {"status": "unaffected", "version": "4.37.237", "lessThan": "4.38.0", "versionType": "semver"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "A vulnerability affecting the detailed versions of\u00a0Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request."}]}], "references": [{"url": "https://info.cryptobox.com/doc/v4.40/4.40.en/", "tags": ["release-notes"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "UNREPORTED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-28T18:33:48.530783Z", "id": "CVE-2026-5794", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T18:33:57.912Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-5794", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-28T18:33:48.530783Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T18:33:53.379Z"}}], "cna": {"title": "Vulnerability in Cryptobox allows an authenticated user to trigger an account lockout", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-2", "descriptions": [{"lang": "en", "value": "CAPEC-2 Inducing Account Lockout"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Ercom", "modules": ["Cryptobox server"], "product": "Cryptobox", "versions": [{"status": "unaffected", "version": "4.40.175"}, {"status": "unaffected", "version": "4.37.237", "lessThan": "4.38.0", "versionType": "semver"}], "defaultStatus": "affected"}], "datePublic": "2026-04-29T14:04:00.000Z", "references": [{"url": "https://info.cryptobox.com/doc/v4.40/4.40.en/", "tags": ["release-notes"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "A vulnerability affecting the detailed versions of\u00a0Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.", "supportingMedia": [{"type": "text/html", "value": "A vulnerability affecting the detailed versions of Cryptobox allows a legitimate user to prevent another to login by triggering an account lockout via sending a specially crafted request.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-694", "description": "CWE-694 Use of multiple resources with duplicate identifier"}]}], "providerMetadata": {"orgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "shortName": "THA-PSIRT", "dateUpdated": "2026-04-29T14:06:08.155Z"}}}, "cveMetadata": {"cveId": "CVE-2026-5794", "state": "PUBLISHED", "dateUpdated": "2026-04-29T14:06:08.155Z", "dateReserved": "2026-04-08T13:20:07.168Z", "assignerOrgId": "9d5917ae-205d-4ae5-8749-1f49479b1395", "datePublished": "2026-04-28T17:09:55.609Z", "assignerShortName": "THA-PSIRT"}, "dataVersion": "5.2"}