The vulnerability identified as CVE-2026-14167 affects ads-tec Industrial IT's DVG-IRF1401 product, specifically version 1.0.0. It is classified under CWE-863 (Incorrect Authorization). The issue permits a remote attacker with low privileges to bypass authorization checks and execute configuration changes reserved for administrators, including managing permissions. The CVSS 4.0 base score is 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges required initially, no user interaction, and high impacts on confidentiality, integrity, and availability. No official patch or remediation level has been published yet, and no known exploits in the wild have been reported.

An attacker with low privileges can remotely perform administrative configuration changes on the affected device, including altering permission settings. This can lead to unauthorized privilege escalation, potentially compromising device security and control. The vulnerability impacts confidentiality, integrity, and availability at a high level, making it a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published, users should monitor vendor communications for updates. Until a patch is available, restrict network access to the device and limit exposure to untrusted networks to reduce the risk of exploitation.