An attacker can use the web interface’s post‑login redirect feature that lacks proper validation to send authenticated users to a malicious site. The flaw is a classic open‑redirect (CWE‑601) and can be exploited to trick users into visiting phishing or malware‑laden URLs, potentially leading to loss of confidentiality and availability of the user’s session or data. The description does not state that an attacker can gain direct system access, but because the attack is performed after authentication, it can be used as a foothold for social engineering or credential harvesting.

The vulnerability affects ad‑s‌tec Industrial IT devices with firmware versions that contain the web UI component, specifically the DVG‑IRF1401, DVG‑IRF1421, DVG‑IRF3401, DVG‑IRF3421, DVG‑IRF3801, and DVG‑IRF3821 product lines. Exact firmware revisions are not listed, so all current releases of these models are potentially affected.

The CVSS score of 6.1 indicates moderate impact, and the EPSS score of less than 1% suggests a low but non‑zero likelihood of exploitation at the time of analysis. The flaw is not listed in CISA KEV, meaning no known widespread exploitation has been reported. The likely attack vector is the public web interface after an attacker has logged in or tricks a legitimate user into authenticating, after which the unvalidated redirect is used. To exploit the flaw the attacker only needs access to the vulnerable web UI, which may be reachable over the local network or exposed to the internet, depending on how the device is deployed.