ID: MEDIUM-07

Title: No rate limiting or account lockout machanism on web interface login

Severity: Medium

CVSS Score: 6.5

CVSS Vector String: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description: The web management interface imposes no rate limiting or account lockout mechanism on failed login attempts. An attacker with network access to the interface can make unlimited authentication attempts without restriction, making the interface susceptible to brute force attacks.

Remediation: Implement rate limiting on the login endpoint and introduce a lockout or progressive delay mechanism after a configurable number of failed attempts.

More information: See Web Interface Analysis chapter.