CVE-2026-35097 Overview
CVE-2026-35097 affects the KTM System e-BOK client service portal. The application enforces a maximum password length of six numeric digits. It rejects alphabetic, special, and extended characters. This weak password policy [CWE-521] leaves accounts exposed to brute-force and credential-guessing attacks against the authenticated web interface. The keyspace of one million possible passwords is trivial to enumerate for a network attacker with no privileges or user interaction. KTM System addressed the issue in a patch published in June 2026.
Critical Impact
Attackers can brute-force any e-BOK user account within a small keyspace of 10^6 combinations, leading to unauthorized access to customer data.
Affected Products
- KTM System e-BOK (Internetowe Biuro Obsługi Klienta) client service portal
- Versions prior to the June 2026 security patch
Discovery Timeline
- 2026-06-30 - CVE-2026-35097 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-35097
Vulnerability Analysis
The e-BOK portal restricts user passwords to six numeric characters. This constraint applies at registration and at password change. The application does not accept letters, punctuation, or extended Unicode characters. As a result, the total password keyspace is 10^6, or one million combinations. A network attacker can enumerate the entire space against a single account within a short time frame, depending on any rate-limiting controls present at the login endpoint. The CVE record does not indicate that account lockout or CAPTCHA mitigations were in place before the fix. The advisory from CERT Poland describes the issue as part of a set of findings against the KTM System client portal.
Root Cause
The root cause is an insufficiently strong password policy [CWE-521]. Developers restricted input to a six-digit numeric PIN rather than accepting a broader character set and enforcing minimum entropy. The design choice trades usability for cryptographic strength and does not meet modern authentication guidance for internet-facing customer portals.
Attack Vector
The attack vector is the network. An unauthenticated attacker submits credentials to the e-BOK login form or its underlying authentication API. The attacker iterates through numeric values from 000000 to 999999 against a known username. Successful authentication grants access to the victim's account and any billing, contract, or personal data exposed through the portal. Refer to the CERT Poland CVE-2026-35095 Analysis for related findings on the same platform.
Detection Methods for CVE-2026-35097
Indicators of Compromise
- High volumes of failed login attempts against the e-BOK authentication endpoint from a single source or distributed sources
- Sequential or incrementing numeric password submissions within HTTP POST bodies to the login handler
- Successful logins immediately following bursts of failures for the same username
- Access from unfamiliar geolocations or user agents shortly after a spike in authentication traffic
Detection Strategies
- Alert on failed authentication counts per username or per source IP exceeding a baseline threshold within a short window
- Correlate authentication failures with subsequent successful logins to identify likely credential-guessing outcomes
- Inspect web server and application logs for repeated POST requests to the login URL with only the password field changing
Monitoring Recommendations
- Ingest e-BOK web server and application authentication logs into a centralized SIEM for correlation
- Track per-account login velocity and set alerts on anomalous rates
- Monitor for password reset and account recovery activity that follows brute-force patterns
How to Mitigate CVE-2026-35097
Immediate Actions Required
- Apply the KTM System patch published in June 2026 to the e-BOK portal
- Force a password reset for all existing users once stronger password rules are in place
- Enforce rate limiting and progressive account lockout on the authentication endpoint
- Enable multi-factor authentication where supported to reduce the impact of password guessing
Patch Information
KTM System published a fix in June 2026 that removes the six-digit numeric restriction. Administrators should confirm the deployed portal version reflects the June 2026 release or later. See the KTMSystem Client Service Information page and the CERT Poland CVE-2026-35095 Analysis for vendor and coordinator details.
Workarounds
- Restrict portal access to known IP ranges or via VPN until the patch is confirmed applied
- Deploy a web application firewall rule to throttle login attempts per source and per account
- Add CAPTCHA challenges after a small number of failed authentications to slow automated guessing
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
