{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERTVDE",
        "summary": "Coordination",
        "urls": [
          "https://certvde.com/en/"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.first.org/cvss/v3.1/specification-document#Qualitative-Severity-Rating-Scale",
      "text": "Medium"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "The ADS-TEC IRF1000 and IRF3000 products in firmware releases prior to 2.3.3, the IRF2000 products in firmware releases prior to 5.0.12 and the ADS-TEC web terminals DVG-SHW9019, DVG-SHW9024, DVG-MEW9016, DVG-MEW9019, DVG-MEW9024, DVG-OPW9016, DVG-OPW9019 and DVG-OPW9024 in AWT1000 software releases prior to 15.0.0 bundle a PHP version that is affected by CVE-2026-109618. In the configuration used by the products, the vulnerability allows a remote attacker to make the web interface temporarily unavailable. No authentication is required, except on IRF2000 firmware prior to 5.0.0, where the web interface is protected by HTTP digest authentication. It is fixed in IRF1000 and IRF3000 firmware 2.3.3, in IRF2000 firmware 5.0.12, which is provided under an extended support plan, and for the web terminals in AWT1000 software 15.0.0. CVE-2026-109619, which was published together with CVE-2026-109618, does not affect the products, because the PHP session extension it requires is disabled at compile time and not included in the products.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "An unauthenticated remote attacker with network access to the web interface can send crafted HTTP requests that exhaust the PHP memory limit while the request is processed.\n\nUpstream confirmed remote code execution for PHP server APIs that keep using the PHP process after the out-of-memory error, such as Apache mod_php: the request cleanup runs on the inconsistent engine state, and the same process then serves further requests. The products run exactly one PHP worker process (php-cgi, without threads). The web server passes the requests to it through a local FastCGI socket, and it handles them one after another; there is no pool of PHP processes. The known attack strategies exhaust the memory while PHP parses the HTTP request data, before the PHP script is started. In this case php-cgi does not run the request cleanup: it shuts down the PHP engine and ends the worker process. As it is the only PHP process, no PHP process with the inconsistent state remains, and the operating system releases its entire memory. A watchdog then starts a new worker with a fresh memory state, which typically takes a few seconds.\n\nThe impact is therefore limited to availability: the web interface is unavailable until the worker has been restarted, and repeated requests keep it unavailable. Confidentiality and integrity are not affected, and routing, VPN and other network functions of the device continue to operate. On IRF2000 firmware prior to 5.0.0, the web interface requires HTTP digest authentication before PHP is reached, so only authenticated users can trigger the condition.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "Restrict access to the web interface to trusted networks.",
        "title": "Mitigation"
      },
      {
        "category": "description",
        "text": "Update to firmware IRF1000 v2.3.3, IRF2000 v5.0.12, IRF3000 v2.3.3 or later, and to AWT1000 software v15.0.0 or later.",
        "title": "Remediation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "psirt@ads-tec.de",
      "name": "ads-tec Industrial IT GmbH",
      "namespace": "https://www.ads-tec-iit.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2026-131: ads-tec Industrial IT: PHP Vulnerability in ADS-TEC IRF Products and Web Terminals - CSAF",
        "url": "https://ads-tec-iit.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-131.json"
      },
      {
        "category": "self",
        "summary": "VDE-2026-131: ads-tec Industrial IT: PHP Vulnerability in ADS-TEC IRF Products and Web Terminals - HTML",
        "url": "https://ads-tec-iit.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-131.html"
      },
      {
        "category": "external",
        "summary": "ads-tec Industrial IT advisories index",
        "url": "https://certvde.com/en/advisories/vendor/ads-tec-iit/"
      }
    ],
    "title": "ads-tec Industrial IT: PHP Vulnerability in ADS-TEC IRF Products and Web Terminals",
    "tracking": {
      "aliases": [
        "VDE-2026-131",
        "ADS2026003"
      ],
      "current_release_date": "2026-11-10T10:00:00.000Z",
      "generator": {
        "date": "2026-11-09T17:44:39.109Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.6.16"
        }
      },
      "id": "VDE-2026-131",
      "initial_release_date": "2026-11-10T10:00:00.000Z",
      "revision_history": [
        {
          "date": "2026-11-10T10:00:00.000Z",
          "number": "1.0.0",
          "summary": "Initial release."
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "DVG-IRF1401",
                    "product": {
                      "name": "DVG-IRF1401",
                      "product_id": "CSAFPID-11001",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF1401:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF1401"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "DVG-IRF1421",
                    "product": {
                      "name": "DVG-IRF1421",
                      "product_id": "CSAFPID-11002",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF1421:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF1421"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_family",
                "name": "IRF1000"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "DVG-IRF2200",
                    "product": {
                      "name": "DVG-IRF2200",
                      "product_id": "CSAFPID-11003",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF2200:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF2200"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "DVG-IRF2210",
                    "product": {
                      "name": "DVG-IRF2210",
                      "product_id": "CSAFPID-11004",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF2210:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF2210"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "DVG-IRF2220",
                    "product": {
                      "name": "DVG-IRF2220",
                      "product_id": "CSAFPID-11005",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF2220:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF2220"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "DVG-IRF2621",
                    "product": {
                      "name": "DVG-IRF2621",
                      "product_id": "CSAFPID-11006",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF2621:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF2621"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "DVG-IRF2601",
                    "product": {
                      "name": "DVG-IRF2601",
                      "product_id": "CSAFPID-11007",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF2601:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF2601"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_family",
                "name": "IRF2000"
              },
              {
                "branches": [
                  {
                    "category": "product_name",
                    "name": "DVG-IRF3401",
                    "product": {
                      "name": "DVG-IRF3401",
                      "product_id": "CSAFPID-11008",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF3401:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF3401"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "DVG-IRF3421",
                    "product": {
                      "name": "DVG-IRF3421",
                      "product_id": "CSAFPID-11009",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF3421:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF3421"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "DVG-IRF3801",
                    "product": {
                      "name": "DVG-IRF3801",
                      "product_id": "CSAFPID-11010",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF3801:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF3801"
                        ]
                      }
                    }
                  },
                  {
                    "category": "product_name",
                    "name": "DVG-IRF3821",
                    "product": {
                      "name": "DVG-IRF3821",
                      "product_id": "CSAFPID-11011",
                      "product_identification_helper": {
                        "cpe": "cpe:2.3:h:ads-tec:DVG-IRF3821:*:*:*:*:*:*:*:*",
                        "model_numbers": [
                          "DVG-IRF3821"
                        ]
                      }
                    }
                  }
                ],
                "category": "product_family",
                "name": "IRF3000"
              },
              {
                "category": "product_name",
                "name": "DVG-SHW9019",
                "product": {
                  "name": "DVG-SHW9019",
                  "product_id": "CSAFPID-11012",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:ads-tec:DVG-SHW9019:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "DVG-SHW9019"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "DVG-SHW9024",
                "product": {
                  "name": "DVG-SHW9024",
                  "product_id": "CSAFPID-11013",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:ads-tec:DVG-SHW9024:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "DVG-SHW9024"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "DVG-MEW9016",
                "product": {
                  "name": "DVG-MEW9016",
                  "product_id": "CSAFPID-11014",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:ads-tec:DVG-MEW9016:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "DVG-MEW9016"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "DVG-MEW9019",
                "product": {
                  "name": "DVG-MEW9019",
                  "product_id": "CSAFPID-11015",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:ads-tec:DVG-MEW9019:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "DVG-MEW9019"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "DVG-MEW9024",
                "product": {
                  "name": "DVG-MEW9024",
                  "product_id": "CSAFPID-11016",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:ads-tec:DVG-MEW9024:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "DVG-MEW9024"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "DVG-OPW9016",
                "product": {
                  "name": "DVG-OPW9016",
                  "product_id": "CSAFPID-11017",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:ads-tec:DVG-OPW9016:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "DVG-OPW9016"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "DVG-OPW9019",
                "product": {
                  "name": "DVG-OPW9019",
                  "product_id": "CSAFPID-11018",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:ads-tec:DVG-OPW9019:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "DVG-OPW9019"
                    ]
                  }
                }
              },
              {
                "category": "product_name",
                "name": "DVG-OPW9024",
                "product": {
                  "name": "DVG-OPW9024",
                  "product_id": "CSAFPID-11019",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:h:ads-tec:DVG-OPW9024:*:*:*:*:*:*:*:*",
                    "model_numbers": [
                      "DVG-OPW9024"
                    ]
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Hardware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:generic/>=1.0.0|<2.3.3",
                "product": {
                  "name": "IRF1000 Firmware 1.0.0<2.3.3",
                  "product_id": "CSAFPID-21001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:ads-tec:irf1000_firmware:*:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:generic/>=1.0.0|<5.0.12",
                "product": {
                  "name": "IRF2000 Firmware 1.0.0<5.0.12",
                  "product_id": "CSAFPID-21002",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:*:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:generic/>=1.0.0|<2.3.3",
                "product": {
                  "name": "IRF3000 Firmware 1.0.0<2.3.3",
                  "product_id": "CSAFPID-21003",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:*:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "2.3.3",
                "product": {
                  "name": "IRF1000 Firmware 2.3.3",
                  "product_id": "CSAFPID-22001",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:ads-tec:irf1000_firmware:2.3.3:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "5.0.12",
                "product": {
                  "name": "IRF2000 Firmware 5.0.12",
                  "product_id": "CSAFPID-22002",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:5.0.12:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "2.3.3",
                "product": {
                  "name": "IRF3000 Firmware 2.3.3",
                  "product_id": "CSAFPID-22003",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:2.3.3:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Firmware"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:generic/>=1.0.0|<15.0.0",
                "product": {
                  "name": "AWT1000 Software 1.0.0<15.0.0",
                  "product_id": "CSAFPID-21004",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ads-tec:awt1000:*:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "15.0.0",
                "product": {
                  "name": "AWT1000 Software 15.0.0",
                  "product_id": "CSAFPID-22004",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:ads-tec:awt1000:15.0.0:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "ads-tec Industrial IT"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:semver/>=8.2.0|<8.2.35",
                "product": {
                  "name": "PHP 8.2.0<8.2.35",
                  "product_id": "CSAFPID-21005",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=8.3.0|<8.3.36",
                "product": {
                  "name": "PHP 8.3.0<8.3.36",
                  "product_id": "CSAFPID-21006",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=8.4.0|<8.4.27",
                "product": {
                  "name": "PHP 8.4.0<8.4.27",
                  "product_id": "CSAFPID-21007",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "vers:semver/>=8.5.0|<8.5.12",
                "product": {
                  "name": "PHP 8.5.0<8.5.12",
                  "product_id": "CSAFPID-21008",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:*:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.2.35",
                "product": {
                  "name": "PHP 8.2.35",
                  "product_id": "CSAFPID-22005",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:8.2.35:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.3.36",
                "product": {
                  "name": "PHP 8.3.36",
                  "product_id": "CSAFPID-22006",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:8.3.36:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.4.27",
                "product": {
                  "name": "PHP 8.4.27",
                  "product_id": "CSAFPID-22007",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:8.4.27:*:*:*:*:*:*:*"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "8.5.12",
                "product": {
                  "name": "PHP 8.5.12",
                  "product_id": "CSAFPID-22008",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:php:php:8.5.12:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "PHP"
          }
        ],
        "category": "vendor",
        "name": "PHP Group"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017",
          "CSAFPID-31018",
          "CSAFPID-31019",
          "CSAFPID-21005",
          "CSAFPID-21006",
          "CSAFPID-21007",
          "CSAFPID-21008"
        ],
        "summary": "Affected products (IRF1000 firmware 1.0.0<2.3.3, IRF2000 firmware 1.0.0<5.0.12, IRF3000 firmware 1.0.0<2.3.3, AWT1000 software 1.0.0<15.0.0)."
      },
      {
        "group_id": "CSAFGID-0002",
        "product_ids": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014",
          "CSAFPID-32015",
          "CSAFPID-32016",
          "CSAFPID-32017",
          "CSAFPID-32018",
          "CSAFPID-32019",
          "CSAFPID-22005",
          "CSAFPID-22006",
          "CSAFPID-22007",
          "CSAFPID-22008"
        ],
        "summary": "Fixed products."
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF1000 Firmware 1.0.0<2.3.3 installed on DVG-IRF1401",
          "product_id": "CSAFPID-31001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf1000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF1000 Firmware 1.0.0<2.3.3 installed on DVG-IRF1421",
          "product_id": "CSAFPID-31002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf1000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF2000 Firmware 1.0.0<5.0.12 installed on DVG-IRF2200",
          "product_id": "CSAFPID-31003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF2000 Firmware 1.0.0<5.0.12 installed on DVG-IRF2210",
          "product_id": "CSAFPID-31004",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF2000 Firmware 1.0.0<5.0.12 installed on DVG-IRF2220",
          "product_id": "CSAFPID-31005",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF2000 Firmware 1.0.0<5.0.12 installed on DVG-IRF2621",
          "product_id": "CSAFPID-31006",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF2000 Firmware 1.0.0<5.0.12 installed on DVG-IRF2601",
          "product_id": "CSAFPID-31007",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21002",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF3000 Firmware 1.0.0<2.3.3 installed on DVG-IRF3401",
          "product_id": "CSAFPID-31008",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF3000 Firmware 1.0.0<2.3.3 installed on DVG-IRF3421",
          "product_id": "CSAFPID-31009",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF3000 Firmware 1.0.0<2.3.3 installed on DVG-IRF3801",
          "product_id": "CSAFPID-31010",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "IRF3000 Firmware 1.0.0<2.3.3 installed on DVG-IRF3821",
          "product_id": "CSAFPID-31011",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21003",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 1.0.0<15.0.0 installed on DVG-SHW9019",
          "product_id": "CSAFPID-31012",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 1.0.0<15.0.0 installed on DVG-SHW9024",
          "product_id": "CSAFPID-31013",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11013"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 1.0.0<15.0.0 installed on DVG-MEW9016",
          "product_id": "CSAFPID-31014",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11014"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 1.0.0<15.0.0 installed on DVG-MEW9019",
          "product_id": "CSAFPID-31015",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11015"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 1.0.0<15.0.0 installed on DVG-MEW9024",
          "product_id": "CSAFPID-31016",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11016"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 1.0.0<15.0.0 installed on DVG-OPW9016",
          "product_id": "CSAFPID-31017",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11017"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 1.0.0<15.0.0 installed on DVG-OPW9019",
          "product_id": "CSAFPID-31018",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11018"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 1.0.0<15.0.0 installed on DVG-OPW9024",
          "product_id": "CSAFPID-31019",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:*:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-21004",
        "relates_to_product_reference": "CSAFPID-11019"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.3.3 installed on DVG-IRF1401",
          "product_id": "CSAFPID-32001",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf1000_firmware:2.3.3:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11001"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.3.3 installed on DVG-IRF1421",
          "product_id": "CSAFPID-32002",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf1000_firmware:2.3.3:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22001",
        "relates_to_product_reference": "CSAFPID-11002"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 5.0.12 installed on DVG-IRF2200",
          "product_id": "CSAFPID-32003",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:5.0.12:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11003"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 5.0.12 installed on DVG-IRF2210",
          "product_id": "CSAFPID-32004",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:5.0.12:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11004"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 5.0.12 installed on DVG-IRF2220",
          "product_id": "CSAFPID-32005",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:5.0.12:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11005"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 5.0.12 installed on DVG-IRF2621",
          "product_id": "CSAFPID-32006",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:5.0.12:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11006"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 5.0.12 installed on DVG-IRF2601",
          "product_id": "CSAFPID-32007",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf2000_firmware:5.0.12:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22002",
        "relates_to_product_reference": "CSAFPID-11007"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.3.3 installed on DVG-IRF3401",
          "product_id": "CSAFPID-32008",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:2.3.3:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11008"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.3.3 installed on DVG-IRF3421",
          "product_id": "CSAFPID-32009",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:2.3.3:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11009"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.3.3 installed on DVG-IRF3801",
          "product_id": "CSAFPID-32010",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:2.3.3:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11010"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Firmware 2.3.3 installed on DVG-IRF3821",
          "product_id": "CSAFPID-32011",
          "product_identification_helper": {
            "cpe": "cpe:2.3:o:ads-tec:irf3000_firmware:2.3.3:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22003",
        "relates_to_product_reference": "CSAFPID-11011"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 15.0.0 installed on DVG-SHW9019",
          "product_id": "CSAFPID-32012",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:15.0.0:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22004",
        "relates_to_product_reference": "CSAFPID-11012"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 15.0.0 installed on DVG-SHW9024",
          "product_id": "CSAFPID-32013",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:15.0.0:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22004",
        "relates_to_product_reference": "CSAFPID-11013"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 15.0.0 installed on DVG-MEW9016",
          "product_id": "CSAFPID-32014",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:15.0.0:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22004",
        "relates_to_product_reference": "CSAFPID-11014"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 15.0.0 installed on DVG-MEW9019",
          "product_id": "CSAFPID-32015",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:15.0.0:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22004",
        "relates_to_product_reference": "CSAFPID-11015"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 15.0.0 installed on DVG-MEW9024",
          "product_id": "CSAFPID-32016",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:15.0.0:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22004",
        "relates_to_product_reference": "CSAFPID-11016"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 15.0.0 installed on DVG-OPW9016",
          "product_id": "CSAFPID-32017",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:15.0.0:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22004",
        "relates_to_product_reference": "CSAFPID-11017"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 15.0.0 installed on DVG-OPW9019",
          "product_id": "CSAFPID-32018",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:15.0.0:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22004",
        "relates_to_product_reference": "CSAFPID-11018"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "AWT1000 Software 15.0.0 installed on DVG-OPW9024",
          "product_id": "CSAFPID-32019",
          "product_identification_helper": {
            "cpe": "cpe:2.3:a:ads-tec:awt1000:15.0.0:*:*:*:*:*:*:*"
          }
        },
        "product_reference": "CSAFPID-22004",
        "relates_to_product_reference": "CSAFPID-11019"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-109618",
      "cwe": {
        "id": "CWE-755",
        "name": "Improper Handling of Exceptional Conditions"
      },
      "notes": [
        {
          "audience": "all",
          "category": "description",
          "text": "PHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request. Some contexts may not properly account for this scenario and leave request memory in an uninitialized state before performing an allocation. The subsequent request cleanup procedure may read or branch on this memory. Multiple OOM strategies can consistently trigger this condition and lead to remote code execution (RCE).",
          "title": "CVE description"
        },
        {
          "audience": "all",
          "category": "details",
          "text": "The published rating of CVE-2026-109618 (CVSS v3.1 base score 9.8, CVSS v4.0 base score 9.2) assumes that the out-of-memory condition leads to remote code execution. Upstream confirmed this for PHP server APIs that run the request cleanup on the inconsistent engine state and keep using the PHP process afterwards, such as Apache mod_php.\n\nThe ADS-TEC products do not use mod_php or PHP-FPM. They run exactly one PHP worker process (php-cgi, without threads) behind the web server; the web server passes the requests to it through a local FastCGI socket, and it handles them one after another. There is no pool of PHP processes. The out-of-memory strategies described upstream exhaust the memory while PHP parses the request data during request startup. When request startup fails, php-cgi does not run the request cleanup on the inconsistent engine state: it shuts down the PHP engine and the worker process exits. As it is the only PHP process, no PHP process with the inconsistent state remains; the operating system releases its memory, and the inconsistent state is never used. Upstream describes the same behavior for PHP-FPM, which ends the worker process when request startup fails and thereby prevents the use of the invalid state. A watchdog then starts a new worker with a fresh memory state.\n\nConfidentiality and integrity are therefore not affected. The only impact is that the web interface is unavailable until the PHP worker has been restarted. This results in the product-specific rating listed as Score 1: CVSS v3.1 base score 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and CVSS v4.0 base score 6.9 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N, see References). Score 2 is the original rating published for the CVE; it applies to the affected PHP versions.",
          "title": "CVE Characterization"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-32001",
          "CSAFPID-32002",
          "CSAFPID-32003",
          "CSAFPID-32004",
          "CSAFPID-32005",
          "CSAFPID-32006",
          "CSAFPID-32007",
          "CSAFPID-32008",
          "CSAFPID-32009",
          "CSAFPID-32010",
          "CSAFPID-32011",
          "CSAFPID-32012",
          "CSAFPID-32013",
          "CSAFPID-32014",
          "CSAFPID-32015",
          "CSAFPID-32016",
          "CSAFPID-32017",
          "CSAFPID-32018",
          "CSAFPID-32019",
          "CSAFPID-22005",
          "CSAFPID-22006",
          "CSAFPID-22007",
          "CSAFPID-22008"
        ],
        "known_affected": [
          "CSAFPID-31001",
          "CSAFPID-31002",
          "CSAFPID-31003",
          "CSAFPID-31004",
          "CSAFPID-31005",
          "CSAFPID-31006",
          "CSAFPID-31007",
          "CSAFPID-31008",
          "CSAFPID-31009",
          "CSAFPID-31010",
          "CSAFPID-31011",
          "CSAFPID-31012",
          "CSAFPID-31013",
          "CSAFPID-31014",
          "CSAFPID-31015",
          "CSAFPID-31016",
          "CSAFPID-31017",
          "CSAFPID-31018",
          "CSAFPID-31019",
          "CSAFPID-21005",
          "CSAFPID-21006",
          "CSAFPID-21007",
          "CSAFPID-21008"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w",
          "url": "https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w"
        },
        {
          "category": "external",
          "summary": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - 9.2 / Critical",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
        },
        {
          "category": "external",
          "summary": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - 6.9 / Medium (product-specific rating for the ads-tec products, see CVE Characterization)",
          "url": "https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"
        }
      ],
      "remediations": [
        {
          "category": "mitigation",
          "details": "Restrict access to the web interface to trusted networks.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Update to firmware IRF1000 2.3.3, IRF2000 5.0.12, IRF3000 2.3.3 or later, and to AWT1000 software 15.0.0 or later.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017",
            "CSAFPID-31018",
            "CSAFPID-31019"
          ]
        },
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-21005",
            "CSAFPID-21006",
            "CSAFPID-21007",
            "CSAFPID-21008"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Denial of service of the web interface. A remote attacker can end the PHP worker process without authentication (on IRF2000 firmware prior to 5.0.0 only with HTTP digest authentication). The web interface is unavailable until the worker has been restarted, typically for a few seconds, and repeated requests keep it unavailable. Code execution is not possible; confidentiality and integrity are not affected. Routing, VPN and other network functions continue to operate.",
          "product_ids": [
            "CSAFPID-31001",
            "CSAFPID-31002",
            "CSAFPID-31003",
            "CSAFPID-31004",
            "CSAFPID-31005",
            "CSAFPID-31006",
            "CSAFPID-31007",
            "CSAFPID-31008",
            "CSAFPID-31009",
            "CSAFPID-31010",
            "CSAFPID-31011",
            "CSAFPID-31012",
            "CSAFPID-31013",
            "CSAFPID-31014",
            "CSAFPID-31015",
            "CSAFPID-31016",
            "CSAFPID-31017",
            "CSAFPID-31018",
            "CSAFPID-31019"
          ]
        }
      ],
      "title": "RCE via OOM corruption"
    }
  ]
}