CVE-2026-14169
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- EPSS probability
- 0.29%
- CWE
- CWE-696
- Published
- 2026-07-28
- Last modified
- 2026-07-28
Affected products
- ads-tec Industrial IT DVG-IRF1401
- ads-tec Industrial IT DVG-IRF1421
- ads-tec Industrial IT DVG-IRF3401
- ads-tec Industrial IT DVG-IRF3421
- ads-tec Industrial IT DVG-IRF3801
- ads-tec Industrial IT DVG-IRF3821
Weakness type
Related vulnerabilities
- CVE-2026-68930 — Russh: Channel-scoped server callbacks can be reached without an open channel
- CVE-2026-44108 — Firewall bypass during shutdown
- CVE-2026-67217 — cJSON JSON Patch Non-Atomic Application Destroys Data Before Validation
- CVE-2026-65100 — Apache Traffic Server: HPACK encoder desynchronizes from the decoder after a failed header encode
- CVE-2026-56355 — GNU Savannah Administration Savane through 3.17 uses untrusted data as part of authorization.
- CVE-2026-49318 — Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
- CVE-2026-49317 — Indian Scout Bobber 2025 Infotainment Digital Round skips PIN entry when WCM is silent at boot
- CVE-2026-44919 — In OpenStack Ironic through 35.x before a3f6d73, during image handling, an infinite loop in...