EUVD-2026-63223
GHSA-xr49-8593-rwjh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify network-accessible FDS 102 web server
-
DeliverySend unauthenticated HTTP GET to /FdsBackup.zip or /downloads/*
-
ExploitReceive sensitive file without session check
-
ExecutionExtract railway signaling and track layout data
-
ImpactConduct physical infrastructure reconnaissance
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond network reachability to the FDS 102 HTTP web server. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote unauthenticated exploitation against default configurations with no attack prerequisites. The specific exploitable paths are /FdsBackup.zip (full backup archive) and /downloads/* (additional sensitive files served without authentication). The primary limiting factor is network segmentation: if the FDS 102 is properly isolated on a dedicated OT network with no internet or broad LAN exposure, the attacker must first gain access to that segment. No authentication, elevated privilege, user interaction, non-default configuration, or specific platform version beyond web server accessibility is required. |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) accurately reflects a zero-friction exploit path: no credentials, no complexity, no user interaction, and no special attack conditions are required. The high confidentiality impact rating is appropriate given that railway signaling and track layout data constitute safety-critical operational intelligence. No EPSS score or CISA KEV listing was provided, which limits confidence in active exploitation estimates; however, the attack surface is effectively zero - a single unauthenticated HTTP GET request retrieves the backup archive. Integrity and availability are not directly impacted by this vulnerability, but the disclosed data could enable sophisticated follow-on attacks against physical railway infrastructure. The primary risk profile is confidentiality loss leading to infrastructure reconnaissance, with downstream physical safety implications that elevate urgency beyond what the CVSS score alone conveys. |
| Exploit ScenarioDerived | An attacker with HTTP access to the FDS 102 web server - whether via an internet-exposed management interface or an unsegmented OT network - issues a plain unauthenticated HTTP GET request to /FdsBackup.zip and immediately receives a backup archive containing railway signaling configuration and track layout data. No exploit code, credentials, or social engineering are required; a standard web browser or curl suffices. The retrieved data can then be used to map physical railway infrastructure, sensor positions, and signaling logic for targeted follow-on attacks against rail operations. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Unauthenticated file disclosure in the Frauscher FDS 102 Field Detection System web interface exposes sensitive railway operational data - including full backup archives and configuration files - to any network-reachable attacker via direct HTTP GET requests. The affected endpoints at /FdsBackup.zip and the /downloads/* directory serve files without session validation, a violation of CWE-306 (Missing Authentication for Critical Function). No CISA KEV listing or public exploit has been identified at time of analysis, but the trivial exploitability - no credentials, no complexity, no user interaction - makes this a high-priority exposure for any railway operator with network-accessible FDS 102 deployments.
RemediationAI
No vendor-released patch version has been confirmed from available data; consult the CERTVDE advisory at https://www.certvde.com/en/advisories/VDE-2026-078/ for patch availability and exact fix versions as they are published. As immediate compensating controls: restrict network access to the FDS 102 web server at the firewall or network layer to authorized management IP ranges only, preventing unauthenticated broad LAN or internet access to the HTTP port - note this may restrict remote monitoring interfaces as a side effect. If the embedded web server is not operationally required, disable it entirely. Place the FDS 102 on an isolated OT/ICS network segment with no direct corporate network or internet connectivity, consistent with IEC 62443 segmentation principles. If a reverse proxy is in use, configure explicit deny rules for the /FdsBackup.zip path and the /downloads/ directory prefix as a partial mitigation pending a vendor patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The Frauscher Sensortechnik FDS 102 (CPE: cpe:2.3:a:frauscher_sensortechnik:fds_102:*:*:*:*:*:*:*:*) is an industrial field detection system used in railway signaling environments. It embeds a web server that serves configuration and backup data over HTTP. The root cause is CWE-306 (Missing Authentication for Critical Function): the web server does not enforce session or credential checks before serving files from /FdsBackup.zip and the /downloads/* path. Railway backup archives and track layout data are safety-sensitive operational technology artifacts; their exposure can reveal physical track topology, sensor placement, and signaling logic. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H) confirms the web server is reachable over the network and requires no prerequisites beyond HTTP access.
Know when Fds 102 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Network-reachable unauthenticated retrieval of sensitive files yields high confidentiality impact; no integrity or availability effect, scope unchanged.
Primary rating from Vendor (CERTVDE).
CVSS VectorVendor: CERTVDE
DescriptionCVE.org
An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be available to unauthenticated users.
Executive ViewAI
The Frauscher FDS 102 Field Detection System web interface contains an unauthenticated file disclosure vulnerability (CVE-2026-14952, CVSS 8.7) that exposes sensitive railway operational data including complete system backups and configurations to any network-reachable attacker. No public exploit identified at time of analysis, but the trivial exploitability and lack of vendor-released patch creates significant risk for railway operators with network-accessible deployments. Immediate network access restrictions and vendor engagement are critical.
Implement firewall rules restricting network access to FDS 102 to authorized administrative networks only; block HTTP requests to /FdsBackup.zip and /downloads/* endpoints at the network edge; deploy reverse proxy or Web Application Firewall with authentication enforcement in front of FDS 102; monitor and alert on access logs for suspicious file download patterns; maintain offline encrypted backups of critical FDS 102 configurations; monitor FDS 102 system behavior for anomalies indicating potential compromise from disclosed configurations; consider temporary unavailability of non-critical FDS 102 functions until patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Session fixation/expiration weakness in the Frauscher Sensortechnik FDS 102 web interface (versions 2.1.0 through 2.13.3
Zip-slip path traversal in Frauscher FDS 102 enables a high-privileged remote attacker to overwrite arbitrary files on t
Session hijacking in Frauscher Sensortechnik FDS 102 versions 2.13.0 through 2.13.3 allows a remote attacker with a low-
Remote code execution is achievable on the Frauscher FDS 102 field data server when a high-privileged attacker uploads a
CSRF in the Frauscher FDS 102 web interface (versions 2.0.0 through 2.13.3) allows a low-privileged remote attacker to c
Privilege escalation in Frauscher FDS 102 (versions 2.11.0 through 2.13.3) allows a low-privileged authenticated attacke
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve t
Exploit-DB