A weakness in Freedom Factory dGEN1 occurs in the com.dgen.alarm component when an attacker can manipulate the component without receiving appropriate authorization. The flaw permits bypassing checks that normally restrain access to alarm‑related functions, potentially allowing unauthorized configuration changes or enabling further exploitation. The vulnerability is rated with a CVSS score of 4.8, indicating a moderate level of severity if exploited in conjunction with other weaknesses. The attack is limited to a local context, meaning the attacker must have physical or local network access to the device.

Freedom Factory dGEN1 devices running firmware versions up to 20260221 are affected. No other products or versions are listed as impacted.

The flaw carries a low EPSS score of less than 1 percent, suggesting a small probability that it will be actively exploited, and it is not currently listed in the CISA KEV catalog. Nonetheless, because the attack vector is local, organizations with exposed dGEN1 devices must verify that they are not running vulnerable firmware. If the device is accessible to employees or insiders, the improper authorization could be leveraged to tamper with alarm settings or create unauthorized actions within the system. The combined CVSS, low exploitation likelihood, and lack of active exploitation reports overall point to a moderate risk that must be mitigated before any potential exploit is seen.