CVE-2026-14168
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
A low-privileged remote attacker can gain administrator privileges due to missing authorization in the configuration table insert path, resulting in full system access.
Risk Assessment
An attacker can gain full control over the device, altering configuration and accessing all data and functions.
Recommendation
Immediately update the device firmware to a version that fixes this vulnerability. Implement the principle of least privilege.
Other vulnerabilities in Unknown device (likely router/network appliance)
See all- CVE-2026-14169High
Due to incorrect behavior order, a low-privileged remote attacker can trigger an inconsistent account state via crafted input and overwrite existing user passwords, potentially resulting in complete administrative unavailability of the device.
- CVE-2026-14167High
A low-privileged remote attacker can perform privileged configuration changes reserved for the administrator, including permission management, due to incorrect authorization.
Original NVD description (English source)
A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.