Frauscher FDS 102 CVE-2026-14951

The attack requires three concurrent conditions: first, the victim must hold an active authenticated session to the FDS 102 web interface (the CVSS 4.0 PR:L metric also indicates the attacker requires low-privileged standing, though the exact nature of that privilege is not specified in available data); second, the victim must be induced to visit an attacker-controlled web page while their FDS 102 session remains active (UI:P - requires user interaction, the primary limiting factor for mass exploitation); third, the FDS 102 web interface must be network-reachable from the victim's browser (AV:N). Exploitation is bounded by the social engineering dependency: this is not a drive-by or automated attack vector. Default-configured instances of the FDS 102 web interface within their affected version range are susceptible, as no special non-default feature flag or configuration appears required beyond having the web interface enabled.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) indicates a network-reachable attack with low complexity, no attack requirements, low attacker privileges, and a single user interaction (the victim visiting a malicious page). High impact across confidentiality, integrity, and availability of the vulnerable system further elevates the score to 8.6. The PR:L metric is notable: it implies the attacker must hold some form of low-privileged standing in the environment - not an entirely unauthenticated external threat actor. UI:P introduces a dependency on social engineering or phishing to induce the authenticated victim to visit the attacker-controlled page, which somewhat constrains opportunistic mass exploitation. No CISA KEV listing and no known public exploit code reduce immediate urgency for most organizations; however, the industrial railway deployment context means successful exploitation of 'unintended actions' could affect safety-critical operations, and the absence of KEV does not imply this is low risk in OT environments. EPSS data is not available in provided intelligence; exploitation probability cannot be quantified from current inputs.

An attacker with low-privileged network presence crafts a malicious HTML page containing a hidden cross-origin form or JavaScript fetch that submits a state-changing request to the FDS 102 web interface. The attacker delivers a link to this page - via phishing email, compromised intranet resource, or injected content - to an FDS 102 operator who is currently authenticated. When the operator's browser loads the malicious page, their session credentials are automatically included in the forged request, causing the FDS 102 to execute the attacker-chosen action (e.g., modifying sensor configuration or diagnostic parameters) without the operator's knowledge or consent.