This vulnerability (CVE-2026-5794) in Ercom Cryptobox involves the use of multiple resources with duplicate identifiers (CWE-694). A legitimate user can exploit this by sending a specially crafted request that triggers an account lockout for another user, effectively denying them access. The affected versions are 4.40.175 and 4.37.237. The CVSS 4.0 base score is 4.9, indicating medium severity, with network attack vector, low attack complexity, and no privileges required for the attacker. No vendor patch or official remediation level has been published as of the data provided.

The impact is a denial-of-service condition where a legitimate user can prevent another user from logging into the system by triggering an account lockout. This could disrupt normal user operations but does not indicate privilege escalation, data disclosure, or system compromise. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor for unusual account lockout patterns and consider temporary controls such as rate limiting or additional authentication checks to mitigate potential abuse. No official remediation or temporary fix has been provided by the vendor at this time.