Fds 102
Monthly
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.
Unauthenticated file disclosure in the Frauscher FDS 102 Field Detection System web interface exposes sensitive railway operational data - including full backup archives and configuration files - to any network-reachable attacker via direct HTTP GET requests. The affected endpoints at /FdsBackup.zip and the /downloads/* directory serve files without session validation, a violation of CWE-306 (Missing Authentication for Critical Function). No CISA KEV listing or public exploit has been identified at time of analysis, but the trivial exploitability - no credentials, no complexity, no user interaction - makes this a high-priority exposure for any railway operator with network-accessible FDS 102 deployments.
CSRF in the Frauscher FDS 102 web interface (versions 2.0.0 through 2.13.3) allows a low-privileged remote attacker to coerce authenticated users into executing unintended actions by directing them to a crafted malicious web page. The CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact against the vulnerable system, driven by the absence of complexity requirements and the low privilege bar for the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, though the industrial railway context of this product elevates operational risk if exploited.
Session fixation/expiration weakness in the Frauscher Sensortechnik FDS 102 web interface (versions 2.1.0 through 2.13.3) allows an attacker holding a valid session identifier to keep using that session after it should have expired, granting continued access to the management interface. Because sessions are not invalidated on the expected schedule, stolen, leaked, shared, or unattended session tokens remain usable well beyond their intended lifetime. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (Critical) reflects high impact once a token is obtained.
Privilege escalation in Frauscher FDS 102 (versions 2.11.0 through 2.13.3) allows a low-privileged authenticated attacker to create new user accounts with arbitrary role values - including the application's highest privilege level - by submitting a crafted request to the PHP endpoint /api/user/add.php. The user creation API fails to enforce authorization on the role parameter (CWE-863: Incorrect Authorization), permitting authenticated non-admins to self-elevate or plant backdoor admin accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector indicates high subsequent-system impact (SC:H/SI:H/SA:H), consistent with this being an OT/industrial railway platform where administrative access can affect connected field devices.
Session hijacking in Frauscher Sensortechnik FDS 102 versions 2.13.0 through 2.13.3 allows a remote attacker with a low-privileged account to fully compromise active administrator sessions without knowing the administrator's password. The device writes live plaintext session identifiers for authenticated users into downloadable error log archives (CWE-532), enabling any authenticated low-privileged user to extract and replay admin tokens. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack requires no specialized tooling and only minimal network access.
Zip-slip path traversal in Frauscher FDS 102 enables a high-privileged remote attacker to overwrite arbitrary files on the server and achieve full system compromise. By uploading a specially crafted ZIP archive containing entries with directory traversal sequences (e.g., ../../etc/cron.d/backdoor), an authenticated attacker can escape the intended extraction directory and plant executable content in sensitive filesystem locations. No public exploit code or active exploitation has been identified at time of analysis, but the direct path from file write to code execution makes this a critical post-authentication escalation risk in industrial environments.
Remote code execution is achievable on the Frauscher FDS 102 field data server when a high-privileged attacker uploads a PHP webshell and retrieves it directly via /uploads/<filename>.php, bypassing file type validation entirely (CWE-434). All versions appear affected per the wildcard CPE string reported by CERTVDE in advisory VDE-2026-078. Full system compromise - including loss of confidentiality, integrity, and availability - is the confirmed worst-case impact, with particular significance in railway operational technology environments where the FDS 102 manages sensor and axle-counting infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.
User enumeration in the Frauscher FDS 102 railway diagnostic system allows low-privileged remote attackers to retrieve the complete list of configured accounts and identify which hold elevated privileges via the unprotected PHP endpoint /api/user/fetch-all.php. The CPE confirms all tracked versions of the FDS 102 are affected, and the CVSS 4.0 vector (PR:L) indicates exploitation requires an existing low-privilege credential but no user interaction. No public exploit code and no active exploitation have been identified at time of analysis; this is reported by CERTVDE under advisory VDE-2026-078.
Unauthenticated file disclosure in the Frauscher FDS 102 Field Detection System web interface exposes sensitive railway operational data - including full backup archives and configuration files - to any network-reachable attacker via direct HTTP GET requests. The affected endpoints at /FdsBackup.zip and the /downloads/* directory serve files without session validation, a violation of CWE-306 (Missing Authentication for Critical Function). No CISA KEV listing or public exploit has been identified at time of analysis, but the trivial exploitability - no credentials, no complexity, no user interaction - makes this a high-priority exposure for any railway operator with network-accessible FDS 102 deployments.
CSRF in the Frauscher FDS 102 web interface (versions 2.0.0 through 2.13.3) allows a low-privileged remote attacker to coerce authenticated users into executing unintended actions by directing them to a crafted malicious web page. The CVSS 4.0 score of 8.6 reflects high confidentiality, integrity, and availability impact against the vulnerable system, driven by the absence of complexity requirements and the low privilege bar for the attacker. No public exploit code or CISA KEV listing has been identified at time of analysis, though the industrial railway context of this product elevates operational risk if exploited.
Session fixation/expiration weakness in the Frauscher Sensortechnik FDS 102 web interface (versions 2.1.0 through 2.13.3) allows an attacker holding a valid session identifier to keep using that session after it should have expired, granting continued access to the management interface. Because sessions are not invalidated on the expected schedule, stolen, leaked, shared, or unattended session tokens remain usable well beyond their intended lifetime. No public exploit identified at time of analysis and the issue is not in CISA KEV, but the CVSS 4.0 base score of 9.2 (Critical) reflects high impact once a token is obtained.
Privilege escalation in Frauscher FDS 102 (versions 2.11.0 through 2.13.3) allows a low-privileged authenticated attacker to create new user accounts with arbitrary role values - including the application's highest privilege level - by submitting a crafted request to the PHP endpoint /api/user/add.php. The user creation API fails to enforce authorization on the role parameter (CWE-863: Incorrect Authorization), permitting authenticated non-admins to self-elevate or plant backdoor admin accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 4.0 vector indicates high subsequent-system impact (SC:H/SI:H/SA:H), consistent with this being an OT/industrial railway platform where administrative access can affect connected field devices.
Session hijacking in Frauscher Sensortechnik FDS 102 versions 2.13.0 through 2.13.3 allows a remote attacker with a low-privileged account to fully compromise active administrator sessions without knowing the administrator's password. The device writes live plaintext session identifiers for authenticated users into downloadable error log archives (CWE-532), enabling any authenticated low-privileged user to extract and replay admin tokens. No public exploit code or active exploitation has been confirmed at time of analysis, but the attack requires no specialized tooling and only minimal network access.
Zip-slip path traversal in Frauscher FDS 102 enables a high-privileged remote attacker to overwrite arbitrary files on the server and achieve full system compromise. By uploading a specially crafted ZIP archive containing entries with directory traversal sequences (e.g., ../../etc/cron.d/backdoor), an authenticated attacker can escape the intended extraction directory and plant executable content in sensitive filesystem locations. No public exploit code or active exploitation has been identified at time of analysis, but the direct path from file write to code execution makes this a critical post-authentication escalation risk in industrial environments.
Remote code execution is achievable on the Frauscher FDS 102 field data server when a high-privileged attacker uploads a PHP webshell and retrieves it directly via /uploads/<filename>.php, bypassing file type validation entirely (CWE-434). All versions appear affected per the wildcard CPE string reported by CERTVDE in advisory VDE-2026-078. Full system compromise - including loss of confidentiality, integrity, and availability - is the confirmed worst-case impact, with particular significance in railway operational technology environments where the FDS 102 manages sensor and axle-counting infrastructure. No public exploit code and no CISA KEV listing have been identified at time of analysis.