CVE-2026-14171: ads-tec Industrial IT IRF Products open redirect in web-UI

CVE-2026-14171 · Severity: medium · CVSS 6.1 · Published 2026-07-28

ADS-TEC Industrial IT IRF series routers are affected by a security flaw in their web management interface. An attacker can create a specially crafted link that, after a user logs in, automatically redirects them to a malicious external website. This can be used in phishing campaigns to steal user credentials or deliver malware by making the malicious site appear to be a legitimate part of the device's configuration process.

Technologies: ads-tec Industrial IT DVG-IRF1401, ads-tec Industrial IT DVG-IRF1421, ads-tec Industrial IT DVG-IRF3401, ads-tec Industrial IT DVG-IRF3421, ads-tec Industrial IT DVG-IRF3801, ads-tec Industrial IT DVG-IRF3821. Vendors: ads-tec Industrial IT.

Quick answers

Is CVE-2026-14171 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-14171 being exploited in the wild.
How severe is CVE-2026-14171?
Medium severity, with a CVSS score of 6.1, published 28 July 2026.
Which products and versions are affected?
ads-tec Industrial IT DVG-IRF1401 2.2.5 to < 2.3.0; ads-tec Industrial IT DVG-IRF1421 2.2.5 to < 2.3.0; ads-tec Industrial IT DVG-IRF3401 2.2.5 to < 2.3.0; ads-tec Industrial IT DVG-IRF3421 2.2.5 to < 2.3.0; and 2 more.
Is there a fix for CVE-2026-14171?
A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-14171 attacked?
It is attacked over the network, in an operating system.
Am I affected by CVE-2026-14171?
Check whether you run ads-tec Industrial IT DVG-IRF1401, ads-tec Industrial IT DVG-IRF1421, ads-tec Industrial IT DVG-IRF3401 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an Open Redirect (CWE-601) located in the web-based user interface of ADS-TEC IRF1000 and IRF3000 industrial routers. The application fails to properly validate the destination URL in the post-login redirect parameter. An unauthenticated remote attacker can craft a URL that points to the legitimate login page but includes a malicious external site in the redirect parameter. If a user follows this link and successfully authenticates, the browser will automatically navigate to the untrusted site. This flaw is fixed in firmware version 2.3.0.

Affected products

  • ads-tec Industrial IT DVG-IRF1401 (IRF1000) 2.2.5 to < 2.3.0
  • ads-tec Industrial IT DVG-IRF1421 (IRF1000) 2.2.5 to < 2.3.0
  • ads-tec Industrial IT DVG-IRF3401 (IRF3000) 2.2.5 to < 2.3.0
  • ads-tec Industrial IT DVG-IRF3421 (IRF3000) 2.2.5 to < 2.3.0
  • ads-tec Industrial IT DVG-IRF3801 (IRF3000) 2.2.5 to < 2.3.0
  • ads-tec Industrial IT DVG-IRF3821 (IRF3000) 2.2.5 to < 2.3.0

Timeline

  • 2026-07-28: advisory
  • 2026-07-28: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.