Freedom Factory dGEN1 devices running firmware versions up to 20260221 contain a flaw in the AlarmService component that allows a local attacker to bypass authorization checks. The vulnerability, identified as improper authorization, enables the attacker to perform privileged operations on the alarm service, potentially leading to unauthorized control or tampering of the system. The weakness aligns with CWE-266 and CWE-285, highlighting improper privilege management and authorization controls.

Vendors affected are Freedom Factory with the dGEN1 product line. All firmware releases dated before or equal to 20260221 are vulnerable. The issue is confined to the AlarmService within the com.dgen.alarm component; newer releases post-20260221 may have resolved the flaw, but users should verify their firmware version.

The CVSS score of 4.8 indicates moderate severity, while an EPSS score of less than 1% suggests a low probability of exploitation in the field. The flaw requires local access to the device, meaning the risk is mitigated for remote attackers but remains significant for anyone with physical or local network access. Since the vulnerability is not listed in the KEV catalog, there is no current evidence of widespread exploitation, but the lack of a vendor response heightens uncertainty. Administrators must verify the firmware version and apply any available vendor update or isolate the device to reduce the local attack surface.