CVE-2026-14167
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A low-privileged remote attacker can perform privileged configuration changes reserved for the administrator, including permission management, due to incorrect authorization.
Risk Assessment
An attacker can escalate privileges and gain unauthorized access to sensitive functions, potentially compromising system security.
Recommendation
Immediately update the device firmware to a version that fixes this vulnerability. Regularly review and update access policies.
Other vulnerabilities in Unknown device (likely router/network appliance)
See all- CVE-2026-14169High
Due to incorrect behavior order, a low-privileged remote attacker can trigger an inconsistent account state via crafted input and overwrite existing user passwords, potentially resulting in complete administrative unavailability of the device.
- CVE-2026-14168High
A low-privileged remote attacker can gain administrator privileges due to missing authorization in the configuration table insert path, resulting in full system access.
Original NVD description (English source)
A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization.