Frauscher FDS 102 CVE-2026-14953

Exploitation requires two concrete conditions: first, the attacker must possess at least one valid low-privilege credential for the FDS 102 system (confirmed by CVSS PR:L); second, the FDS 102 web interface must be reachable from the attacker's network position (confirmed by CVSS AV:N). No special configuration, non-default feature, or specific platform version is cited as required - the endpoint /api/user/fetch-all.php appears to be present in standard deployments. Exploitation is limited by the authentication prerequisite: unauthenticated access is not supported by available data, meaning the attacker must already belong to the system's user base or have compromised a valid account. The low confidentiality impact (VC:L) further constrains the direct harm to user enumeration and privilege mapping, not credential extraction or operational data access.

The CVSS 4.0 score of 5.3 (Medium) reflects an accurate signal: VC:L captures partial confidentiality loss (user list and privilege mapping, not credentials or operational data), and PR:L correctly gates exploitation on possession of at least one valid credential. No EPSS data is available to quantify exploitation probability. The vulnerability is not listed in CISA KEV, and no POC has been identified. In a general IT context this would be a low-urgency finding, but the OT/ICS deployment context of railway diagnostics elevates operational concern: privilege-level mapping of administrative accounts can directly enable targeted credential attacks or social engineering against high-value operators managing safety-critical infrastructure. The AV:N attack vector means the endpoint is reachable over the network, but the PR:L requirement substantially limits the attacker pool to insiders, compromised accounts, or those who have already obtained credentials by other means. No conflicting signals were observed, but patch version information is absent from available data.

An attacker holding any valid low-privilege account - such as a read-only monitoring credential - authenticates to the FDS 102 web interface and issues an HTTP request to /api/user/fetch-all.php, receiving a response that lists all configured usernames and their associated privilege levels. With this map of administrative accounts in hand, the attacker can target high-value credentials for brute-force, phishing, or session hijacking to escalate privileges within the railway diagnostic system. No POC has been publicly identified, but the endpoint path and PHP implementation make manual exploitation trivially reproducible by any authenticated user.