CVE-2026-14169 — ads-tec Industrial IT: Account lockout via non-atomic user creation

Description (CNA)

Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.

Affected (CNA)

Vendor / product	Versions
ads-tec Industrial IT / DVG-IRF1401	affected 1.0.0 before 2.3.0
ads-tec Industrial IT / DVG-IRF1421	affected 1.0.0 before 2.3.0
ads-tec Industrial IT / DVG-IRF3401	affected 1.0.0 before 2.3.0
ads-tec Industrial IT / DVG-IRF3421	affected 1.0.0 before 2.3.0
ads-tec Industrial IT / DVG-IRF3801	affected 1.0.0 before 2.3.0
ads-tec Industrial IT / DVG-IRF3821	affected 1.0.0 before 2.3.0

CWE

CWE-696

References

https://www.certvde.com/en/advisories/VDE-2026-076/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.