Ercom Cryptobox EUVD-2026-26070

Exploitation requires an active, authenticated low-privileged Cryptobox account, confirmed by PR:L in the CVSS 4.0 vector - unauthenticated external attackers cannot trigger this vulnerability. The attacker must also know a valid victim username within the same Cryptobox instance. The attack is network-accessible (AV:N) with no additional platform-specific attack requirements (AT:N). Limiting factors include: membership in the same Cryptobox tenant or domain as the victim; possession of a valid, non-locked Cryptobox account; and knowledge of the victim's account identifier. The impact is a reversible lockout state, not persistent access or data compromise. SSVC 'Automatable: no' indicates that at-scale automated targeting of multiple victims is not straightforward, reducing mass-disruption risk.

The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VA:H) yields a score of 4.9, reflecting network-accessible, low-complexity exploitation with a high availability impact but no confidentiality or integrity compromise. Real-world risk signals are substantially lower than even this moderate score suggests: EPSS is 0.04% at the 13th percentile, SSVC marks exploitation as 'none' and automatable as 'no', and the vulnerability is absent from CISA KEV. The SSVC 'Automatable: no' finding is the most significant qualifier - despite low attack complexity in CVSS, targeting a specific victim account requires knowledge of valid usernames and deliberate manual action, limiting mass exploitation. Account lockout is also reversible by an administrator, unlike persistent compromise. This vulnerability is best characterized as a targeted disruption risk relevant to high-value environments (government, defense) where Cryptobox is deployed, not a widespread emergency. The 'Information Disclosure' tag in the source data does not match the described behavior (account lockout DoS) and appears to be a mislabeling - this should be noted as a data quality issue.

An authenticated Cryptobox user with a low-privileged account sends a specially crafted request targeting a colleague's or administrator's account username, causing the lockout counter to increment against the victim rather than the attacker. The victim is denied login access until an administrator manually resets the lockout. No public exploit code has been identified; successful targeting requires knowing a valid victim username and holding an active Cryptobox account.