Vulnerability Description
KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient brute‑force attacks against user accounts. When combined with vulnerability CVE-2026-35097, where passwords are restricted to a six‑digit numeric format, this becomes a critical issue, as such passwords can be brute‑forced in a relatively short time. This issue was fixed in the patch published in June 2026.
Related Weaknesses (CWE)
References
- https://cert.pl/posts/2026/06/CVE-2026-35095/
- https://ktmsystem.pl/internetowe-biuro-obslugi-klienta/
FAQ
What is CVE-2026-35098?
CVE-2026-35098 is a documented vulnerability. KTM System e-BOK does not implement any limit or timeout on consecutive login attempts, allowing an attacker to perform unlimited authentication requests. This lack of rate‑limiting enables efficient ...
How severe is CVE-2026-35098?
CVSS scoring is not yet available for CVE-2026-35098. Check NVD for updates.
Is there a patch for CVE-2026-35098?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.