Frauscher FDS 102 CVE-2026-14946

Exploitation requires high-privileged authenticated access to the FDS 102 web interface, as confirmed by the CVSS 4.0 PR:H metric - an unauthenticated attacker cannot exploit this vulnerability. The file upload feature must be accessible to the authenticated session, and the /uploads/ directory must be served by a PHP-capable web server without execution restrictions on that path (which the description implies is the default deployment behavior). Network reachability to the management interface is required (AV:N). Limiting factors include: the PR:H credential barrier (the most significant real-world constraint), network segmentation that isolates OT management interfaces from untrusted networks, and any web server hardening that strips PHP execution permissions from upload directories.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) reflects a meaningful tension: the full H/H/H impact triad signals catastrophic consequences, yet the PR:H requirement represents a genuine exploitation barrier - an attacker must already hold high-privileged credentials before the upload path is accessible. This substantially narrows the realistic threat population to insider threats, credential-compromise scenarios, or environments using shared or weak administrative passwords. No EPSS score was provided; without it, probabilistic exploitation likelihood cannot be quantified. The absence of a CISA KEV listing and no identified public exploit code are consistent with a newly-disclosed OT/niche vulnerability that has not yet attracted broad attacker attention. The SC/SI/SA values of N suggest no confirmed cross-system scope change in the base score, though in a rail operations context a compromised FDS 102 could have broader operational or safety implications not captured by CVSS alone - defenders in critical infrastructure roles should weigh this carefully regardless of the raw score.

An attacker who has obtained high-privileged FDS 102 credentials - through phishing, credential reuse, or insider access - authenticates to the management web interface and submits a PHP webshell (e.g., a file executing OS commands passed via HTTP parameters) through the upload functionality. The attacker then issues a direct HTTP GET request to /uploads/<webshell>.php, causing the PHP runtime to execute the script with the web server process's privileges, yielding an interactive command execution foothold on the underlying system. No public exploit code has been identified at time of analysis, but the technique is elementary and well-documented in offensive security literature.