Frauscher FDS 102 EUVD-2026-63218

Exploitation requires the attacker to hold high-privileged (administrative) credentials on the FDS 102 - this is explicitly encoded as PR:H in the CVSS 4.0 vector and described as 'high-privileged remote attacker' in the advisory. The ZIP archive upload functionality must be accessible to that authenticated session; if upload capability is restricted to specific roles or disabled, exploitation is blocked. Exploitation is limited by the credential requirement: unauthenticated remote attackers cannot trigger the vulnerability. The wildcard CPE version implies no firmware version is exempt, so the version of FDS 102 firmware does not itself limit exposure. No additional non-default configuration is stated as required beyond possessing a valid high-privileged account.

The CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact on the vulnerable system itself, with no subsequent-system impact (SC:N/SI:N/SA:N), meaning the blast radius is contained to the FDS 102 device. The PR:H requirement is a meaningful risk mitigator: an attacker must first obtain high-privileged credentials, substantially narrowing the realistic threat population to insiders, credential-theft victims, or attackers who have already compromised an administrative account. No EPSS score is available in the provided data, and this CVE is absent from the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. The SSVC exploitation dimension is 'none' at time of analysis, though the automatable dimension is low given the authentication gate. For railway and critical infrastructure operators, the combination of industrial context, potential full-system compromise, and the ease of exploitation once authenticated warrants prioritized patching over standard enterprise timelines. The wildcard CPE version field (*) implies all FDS 102 firmware versions may be affected.

An attacker with stolen or insider high-privileged credentials to the FDS 102 administrative interface crafts a ZIP archive whose entries use '../' sequences to target writable locations outside the extraction directory - for example, planting a web shell in the application's web root or overwriting a startup script. Upon uploading and triggering extraction, the server writes the malicious file to the traversed path, after which the attacker executes code under the server process context, achieving full system compromise. No public proof-of-concept has been identified at time of analysis, but zip-slip exploitation is a well-understood and easily replicated technique.