Skip to content
OpenAdvisories
High · 8.1 CVE-2026-14169 EUVD-2026-49730GHSA-p3wp-7mgp-fwjp

ads-tec Industrial IT: Account lockout via non-atomic user creation

Published Jul 28, 2026 · Updated Jul 28, 2026 · Assigned by CERTVDE

Vendor: ads-tec Industrial IT Product: DVG-IRF1401 Product: DVG-IRF1421 Product: DVG-IRF3401 Product: DVG-IRF3421 Product: DVG-IRF3801 Product: DVG-IRF3821

Description

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.

Affected products

VendorProductAffectedFixed
ads-tec Industrial IT DVG-IRF1401 1.0.0 – < 2.3.0 2.3.0
ads-tec Industrial IT DVG-IRF1421 1.0.0 – < 2.3.0 2.3.0
ads-tec Industrial IT DVG-IRF3401 1.0.0 – < 2.3.0 2.3.0
ads-tec Industrial IT DVG-IRF3421 1.0.0 – < 2.3.0 2.3.0
ads-tec Industrial IT DVG-IRF3801 1.0.0 – < 2.3.0 2.3.0
ads-tec Industrial IT DVG-IRF3821 1.0.0 – < 2.3.0 2.3.0

Advisories 2

References