Ads-Tec Industrial IT - CraftedSignal Threat Feed

CVE-2026-14169: Ads-tec DVG-IRF Series Vulnerability Allows Remote Admin Lockout

hello@craftedsignal.io — Tue, 28 Jul 2026 09:22:56 +0000

CVE-2026-14169 details a high-severity vulnerability affecting ads-tec Industrial IT DVG-IRF series devices, including models DVG-IRF1401, DVG-IRF1421, DVG-IRF3401, DVG-IRF3421, DVG-IRF3801, and DVG-IRF3821, specifically versions prior to 2.3.0. A low-privileged remote attacker can exploit an "Incorrect Behavior Order" (CWE-696) flaw by sending specially crafted input. This manipulation allows the attacker to trigger an inconsistent account state, leading to the overwriting of existing user passwords. The vulnerability's exploitation results in complete administrative unavailability of the affected device, posing a significant operational risk for organizations utilizing these industrial IT products due to the loss of control and potential for disruption.

Attack Chain

A low-privileged remote attacker identifies an exposed ads-tec Industrial IT DVG-IRF series device.
The attacker crafts specific input designed to exploit the "Incorrect Behavior Order" (CWE-696) vulnerability (CVE-2026-14169).
This crafted input is sent to the vulnerable device over the network.
Due to the improper sequencing of internal operations within the device, it enters an inconsistent account state.
The inconsistent state allows the attacker's crafted input to successfully overwrite existing administrative user passwords.
Legitimate administrators are locked out of the device, rendering it administratively unavailable.
The attacker achieves their objective of causing denial of administrative access to the device.

Impact

The successful exploitation of CVE-2026-14169 results in complete administrative unavailability of the affected ads-tec Industrial IT DVG-IRF series devices (models DVG-IRF1401, DVG-IRF1421, DVG-IRF3401, DVG-IRF3421, DVG-IRF3801, DVG-IRF3821, all versions prior to 2.3.0). Attackers can overwrite existing user passwords, effectively locking out legitimate administrators from managing the device. This could lead to severe operational disruptions, as critical industrial control or network infrastructure managed by these devices becomes unmanageable, potentially requiring physical access or device reset for recovery. The loss of administrative control could enable further compromise or disruption depending on the device's specific function in the environment.

Recommendation

Patch CVE-2026-14169 on all affected ads-tec Industrial IT DVG-IRF series devices by upgrading to version 2.3.0 or later.
Consult the CERT VDE advisory at https://www.certvde.com/en/advisories/VDE-2026-076/ for vendor-specific patch availability and deployment instructions.

CVE-2026-14168: ads-tec Industrial IT DVG-IRF Privilege Escalation

hello@craftedsignal.io — Tue, 28 Jul 2026 09:21:55 +0000

CVE-2026-14168 is a high-severity privilege escalation vulnerability affecting multiple ads-tec Industrial IT DVG-IRF series products, specifically versions prior to 2.3.0. The vulnerability stems from a critical missing authorization check (CWE-862) at the "insert path of the configuration table." This flaw enables a remote attacker with low-level privileges to bypass security controls and arbitrarily modify the device's configuration. By exploiting this, an attacker can create new administrative accounts or elevate the privileges of an existing low-privileged account, leading to full compromise of the system. The vulnerability has a CVSS v3.1 base score of 8.8 (High). This vulnerability poses a significant risk to the integrity and confidentiality of industrial control systems using these devices, as it allows unauthorized control and potential disruption of critical operations.

Attack Chain

A remote attacker with existing low-privileged credentials gains network access to a vulnerable ads-tec Industrial IT DVG-IRF series device (version < 2.3.0).
The attacker identifies the specific "insert path of the configuration table" endpoint or mechanism within the device's management interface.
The attacker crafts a malicious request targeting this identified configuration endpoint, designed to either modify an existing user's privileges or create a new user with administrative rights.
Due to the critical missing authorization check (CWE-862) associated with the configuration table's insert path, the device fails to properly validate the attacker's insufficient permissions for the proposed administrative change.
The device processes the unauthorized configuration modification request, successfully updating the internal configuration table to grant administrative privileges to the attacker-controlled account.
The attacker then authenticates to the DVG-IRF device using the newly acquired administrator credentials.
Upon successful authentication, the attacker gains full system access and control over the vulnerable industrial device.

Impact

Successful exploitation of CVE-2026-14168 allows a low-privileged attacker to escalate to full administrator privileges on the affected ads-tec Industrial IT DVG-IRF series products. This complete system access means the attacker can manipulate, disrupt, or completely shut down the affected device. In industrial environments, this could lead to operational downtime, compromise sensitive data, or allow for further lateral movement into critical infrastructure. Given that these devices are often used in sensitive industrial IT contexts, the direct impact on system integrity and availability could be severe, potentially affecting production lines, safety systems, or data integrity.

Recommendation

Patch CVE-2026-14168 immediately by upgrading ads-tec Industrial IT DVG-IRF series products to version 2.3.0 or later as recommended by CERT VDE and ads-tec Industrial IT.
Review network segmentation to limit direct remote access to affected ads-tec Industrial IT DVG-IRF devices to only necessary management networks.
Monitor logs for unusual configuration changes or attempts to modify user privileges, particularly related to the "insert path of the configuration table" which is referenced in CVE-2026-14168.
Implement strong authentication mechanisms and enforce the principle of least privilege for all users accessing ads-tec Industrial IT DVG-IRF devices.

CVE-2026-14167: ads-tec Industrial IT DVG-IRF Series Privilege Escalation Vulnerability

hello@craftedsignal.io — Tue, 28 Jul 2026 09:21:02 +0000

CVE-2026-14167 describes a critical authorization bypass vulnerability affecting several ads-tec Industrial IT DVG-IRF series products, including DVG-IRF1401, DVG-IRF1421, DVG-IRF3401, DVG-IRF3421, DVG-IRF3801, and DVG-IRF3821 with versions prior to 2.3.0. This flaw allows a low-privileged remote attacker to circumvent authorization checks and execute configuration changes that are typically restricted to administrator-level users. This includes sensitive actions such as managing system permissions, potentially leading to complete compromise of the affected devices. The vulnerability carries a CVSS v3.1 base score of 8.8 (High), highlighting its severe impact on confidentiality, integrity, and availability. Organizations using these industrial IT devices are strongly advised to review their deployed versions and apply updates to prevent unauthorized access and control.

Attack Chain

Initial Access: A remote attacker gains low-privileged access to an affected ads-tec Industrial IT DVG-IRF series device. The method for initial low-privileged access is not detailed but typically involves legitimate credentials or another, less severe vulnerability.
Authorization Bypass: The attacker identifies and exploits the incorrect authorization vulnerability (CWE-863) within the device's management interface or API.
Privileged Configuration Change Request: The attacker crafts and sends requests to the device's management interface or API, attempting to modify configuration settings that usually require administrator privileges.
System Accepts Unauthorized Change: Due to the authorization bypass, the device incorrectly validates the attacker's low-privileged session as having sufficient permissions.
Permission Management: The attacker successfully executes privileged actions, such as modifying user permissions, creating new administrative accounts, or altering critical system settings.
Privilege Escalation: The attacker elevates their privileges on the device, gaining full administrative control over the affected industrial IT product.
System Compromise: With administrative control, the attacker can manipulate device functions, inject malicious configurations, access sensitive data, or disrupt operations.

Impact

Successful exploitation of CVE-2026-14167 grants a low-privileged remote attacker the ability to perform administrative actions, leading to a complete compromise of the affected ads-tec Industrial IT DVG-IRF series devices. This can result in unauthorized access to sensitive operational technology (OT) or industrial control system (ICS) configurations, disruption of critical infrastructure processes, or data manipulation. Given these are industrial IT products, the impact could extend to significant operational downtime, safety hazards, environmental damage, or severe financial losses. The specific number of affected organizations or observed exploitation is not detailed, but the high CVSS score indicates a substantial risk.

Recommendation

Immediately patch all affected ads-tec Industrial IT DVG-IRF series products (DVG-IRF1401, DVG-IRF1421, DVG-IRF3401, DVG-IRF3421, DVG-IRF3801, DVG-IRF3821) to version 2.3.0 or later as advised in the CERT VDE advisory for CVE-2026-14167.
Review network segmentation and access control policies for devices listed in the affected_products section to minimize exposure to unauthorized remote access.
Monitor authentication and authorization logs for unusual configuration changes or login attempts on ads-tec Industrial IT devices.