{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/dvg-irf3401-versions--2.3.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":8.8,"id":"CVE-2026-14167"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["DVG-IRF1401 (versions \u003c 2.3.0)","DVG-IRF1421 (versions \u003c 2.3.0)","DVG-IRF3401 (versions \u003c 2.3.0)","DVG-IRF3421 (versions \u003c 2.3.0)","DVG-IRF3801 (versions \u003c 2.3.0)","DVG-IRF3821 (versions \u003c 2.3.0)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","privilege-escalation","authorization-bypass","ICS","OT"],"_cs_type":"advisory","_cs_vendors":["ads-tec Industrial IT"],"content_html":"\u003cp\u003eCVE-2026-14167 describes a critical authorization bypass vulnerability affecting several ads-tec Industrial IT DVG-IRF series products, including DVG-IRF1401, DVG-IRF1421, DVG-IRF3401, DVG-IRF3421, DVG-IRF3801, and DVG-IRF3821 with versions prior to 2.3.0. This flaw allows a low-privileged remote attacker to circumvent authorization checks and execute configuration changes that are typically restricted to administrator-level users. This includes sensitive actions such as managing system permissions, potentially leading to complete compromise of the affected devices. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), highlighting its severe impact on confidentiality, integrity, and availability. Organizations using these industrial IT devices are strongly advised to review their deployed versions and apply updates to prevent unauthorized access and control.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access\u003c/strong\u003e: A remote attacker gains low-privileged access to an affected ads-tec Industrial IT DVG-IRF series device. The method for initial low-privileged access is not detailed but typically involves legitimate credentials or another, less severe vulnerability.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthorization Bypass\u003c/strong\u003e: The attacker identifies and exploits the incorrect authorization vulnerability (CWE-863) within the device's management interface or API.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePrivileged Configuration Change Request\u003c/strong\u003e: The attacker crafts and sends requests to the device's management interface or API, attempting to modify configuration settings that usually require administrator privileges.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSystem Accepts Unauthorized Change\u003c/strong\u003e: Due to the authorization bypass, the device incorrectly validates the attacker's low-privileged session as having sufficient permissions.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePermission Management\u003c/strong\u003e: The attacker successfully executes privileged actions, such as modifying user permissions, creating new administrative accounts, or altering critical system settings.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePrivilege Escalation\u003c/strong\u003e: The attacker elevates their privileges on the device, gaining full administrative control over the affected industrial IT product.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSystem Compromise\u003c/strong\u003e: With administrative control, the attacker can manipulate device functions, inject malicious configurations, access sensitive data, or disrupt operations.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-14167 grants a low-privileged remote attacker the ability to perform administrative actions, leading to a complete compromise of the affected ads-tec Industrial IT DVG-IRF series devices. This can result in unauthorized access to sensitive operational technology (OT) or industrial control system (ICS) configurations, disruption of critical infrastructure processes, or data manipulation. Given these are industrial IT products, the impact could extend to significant operational downtime, safety hazards, environmental damage, or severe financial losses. The specific number of affected organizations or observed exploitation is not detailed, but the high CVSS score indicates a substantial risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately patch all affected ads-tec Industrial IT DVG-IRF series products (DVG-IRF1401, DVG-IRF1421, DVG-IRF3401, DVG-IRF3421, DVG-IRF3801, DVG-IRF3821) to version 2.3.0 or later as advised in the CERT VDE advisory for CVE-2026-14167.\u003c/li\u003e\n\u003cli\u003eReview network segmentation and access control policies for devices listed in the affected_products section to minimize exposure to unauthorized remote access.\u003c/li\u003e\n\u003cli\u003eMonitor authentication and authorization logs for unusual configuration changes or login attempts on ads-tec Industrial IT devices.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-28T09:21:02Z","date_published":"2026-07-28T09:21:02Z","id":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14167/","summary":"A low-privileged remote attacker can exploit CVE-2026-14167, an incorrect authorization vulnerability in multiple ads-tec Industrial IT DVG-IRF series products, to perform privileged configuration changes, including permission management, leading to privilege escalation.","title":"CVE-2026-14167: ads-tec Industrial IT DVG-IRF Series Privilege Escalation Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-07-cve-2026-14167/"}],"language":"en","title":"CraftedSignal Threat Feed - DVG-IRF3401 (Versions \u003c 2.3.0)","version":"https://jsonfeed.org/version/1.1"}