CVE-2026-14169
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Due to incorrect behavior order, a low-privileged remote attacker can trigger an inconsistent account state via crafted input and overwrite existing user passwords, potentially resulting in complete administrative unavailability of the device.
Risk Assessment
An attacker can lock out administrative access to the device, preventing management and potentially causing service disruptions.
Recommendation
Immediately update the device firmware to a version that fixes this vulnerability. Restrict access to the management interface to trusted networks only.
Other vulnerabilities in Unknown device (likely router/network appliance)
See all- CVE-2026-14168High
A low-privileged remote attacker can gain administrator privileges due to missing authorization in the configuration table insert path, resulting in full system access.
- CVE-2026-14167High
A low-privileged remote attacker can perform privileged configuration changes reserved for the administrator, including permission management, due to incorrect authorization.
Original NVD description (English source)
Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.