This vulnerability (CVE-2026-14171) in ads-tec Industrial IT DVG-IRF1401 involves improper validation of the post-login redirect URL in the web user interface. An unauthenticated attacker can craft a URL that causes the application to redirect users to an untrusted external site after login. This open redirect (CWE-601) can be abused to trick users into visiting malicious sites, potentially resulting in confidentiality and availability impacts. The vulnerability affects version 2.2.5. There is no vendor advisory or patch information available at this time.

Exploitation of this vulnerability allows attackers to redirect users to malicious websites after login, which can lead to loss of confidentiality (e.g., phishing or credential theft) and availability impacts. The CVSS vector indicates the attack requires no privileges but does require user interaction. The scope is changed, meaning the vulnerability affects resources beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should be cautious of unexpected redirects after login and verify URLs before following them. Network defenders may consider monitoring for suspicious redirect patterns related to this product.