The vulnerability CVE-2026-14169 in ads-tec Industrial IT DVG-IRF1401 version 1.0.0 is caused by an incorrect behavior order (CWE-696). This flaw enables a low privileged remote attacker to trigger an inconsistent account state through crafted input, resulting in overwriting existing user passwords. The consequence is a loss of administrative access, rendering the device administratively unavailable. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and high availability impact.

An attacker with low privileges can remotely exploit this vulnerability to overwrite user passwords, causing administrative accounts to become inaccessible. This leads to complete administrative unavailability of the device, impacting device management and potentially disrupting operations dependent on the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been published at this time. Users should monitor vendor communications for updates and consider restricting remote access to the device until a fix is available.