Frauscher FDS 102 CVE-2026-14948

Exploitation requires a valid low-privileged authenticated account on the Frauscher FDS 102 device - this is the specific prerequisite confirmed by the CVSS 4.0 PR:L metric. The attacker must have access to the error log archive download feature, which is the precise application capability that exposes session tokens; if this feature is inaccessible to low-privileged roles, exploitation is blocked. An active administrator session must exist on the device at the time the relevant log entries are written - if no administrator is concurrently logged in, no admin session token will appear in the logs. The attack is scoped to versions 2.13.0 through 2.13.3 and does not require physical access, adjacent network positioning, or elevated privileges beyond a basic account. Network-level access to the device management interface is required (AV:N), but no special protocol or configuration mode is needed beyond standard authenticated HTTP access.

The CVSS 4.0 score of 8.7 accurately reflects the low exploitation barrier: any authenticated low-privileged user can execute this attack over the network with no special conditions beyond having an account on the device. The full high-impact triad (VC:H/VI:H/VA:H) is justified because successful session hijacking grants unrestricted administrative control, enabling configuration changes, operational disruption, or data exfiltration. No EPSS score is available in the provided data, and the vulnerability is not listed in CISA KEV, so exploitation probability and active threat actor interest cannot be quantified. However, the attack technique - download logs, extract token, replay - is trivially simple and requires no exploit development. The OT/industrial deployment context is the key risk amplifier: admin compromise of a railway field device can carry safety and operational consequences that CVSS numerical scoring does not capture. The absence of a scope change metric (SC:N/SI:N/SA:N) suggests the assessed impact is bounded to the FDS 102 device itself, but operators should assess whether the device's administrative plane connects to broader ICS/SCADA infrastructure. The primary limiting factor is that exploitation requires a pre-existing low-privileged account on the device.

An attacker holding a low-privileged account on an FDS 102 device in the affected version range waits until or confirms that an administrator session is active, then downloads the error log archive using standard HTTP tools available to their privilege level. The attacker parses the log file, locates the administrator's plaintext session token, and injects it into their own HTTP client or browser, immediately gaining full administrative control of the device without any password knowledge. No public proof-of-concept has been identified at time of analysis, but the attack requires no custom tooling.