Frauscher FDS 102 EUVD-2026-63221

Exploitation requires the attacker to already possess a valid session identifier for the FDS 102 web interface (reflected as AT:P in the CVSS 4.0 vector) - obtained via a stolen, leaked, shared, or unattended session - and network reachability to that interface. The limiting factors are precisely this token-possession prerequisite (the flaw does not create a session, only prolongs one) and network exposure of the web interface; there is no separate authentication or user-interaction requirement once a token is held (PR:N/UI:N). Deployments where the interface is network-isolated and tokens are tightly controlled are substantially harder to exploit.

The signals are mixed but lean toward high-priority for exposed deployments: the CVSS 4.0 base score is 9.2 (Critical) with network attack vector, low complexity, no privileges and no user interaction, and High confidentiality/integrity/availability impact on the vulnerable system. Critically, however, the vector includes AT:P - exploitation is gated on the attacker first obtaining a valid session identifier, which meaningfully lowers real-world likelihood versus a true no-precondition RCE. No EPSS score, POC, or KEV listing is provided, so there is no evidence of active or automatable mass exploitation at this time; the realistic threat is targeted reuse of leaked, shared, or unattended tokens rather than internet-wide scanning. Any operator running FDS 102 on a reachable network - from a large rail infrastructure owner down to a small municipal or regional transit maintenance team - should treat this as urgent given the industrial/safety context, while recognizing the token-possession requirement caps its wormability. If the web interface is not internet-exposed and session tokens are well protected, effective risk drops considerably.

An attacker obtains a valid FDS 102 session identifier - for example from a shared workstation left logged in, a captured or logged token, or an unattended browser - and, because the server does not enforce the intended expiration, continues issuing authenticated requests to the web interface long after the legitimate user believed the session had ended. With network access to the interface and low attack complexity, the attacker reads and manipulates the diagnostic/management functions under the victim's identity. No public exploit code is required or identified; the attack reuses an ordinary session token.