Eight Frauscher FDS102 Vulnerabilities: Session, File, and Authorization Risks

Eight flaws across one management surface

Frauscher FDS102 provides web-based diagnostics and configuration for axle-counting environments. CERT@VDE advisory VDE-2026-078 describes eight vulnerabilities spanning file handling, archive extraction, session management, authorization, request forgery, backup access, and user enumeration. They should be treated as a connected management-plane risk rather than eight unrelated identifiers.

The shared upper affected boundary is FDS102 2.13.3, although several issues begin in later releases. Frauscher addresses the group in FDS102 2.14.0. Operators should first identify the installed release and the management interface exposure, then restrict access, schedule the official update, and validate the device after the change.

File upload and archive extraction

CVE-2026-14946 affects versions 2.8.0 through 2.13.3. Insufficient file-type validation lets a low-privileged authenticated user upload PHP content that may execute with the web server's privileges. CVE-2026-14947 affects the same range and concerns path validation while extracting ZIP archives, allowing files to be written outside the intended directory and potentially leading to code execution.

Authentication is required for these two paths, but that does not make them harmless. A stolen or over-privileged maintenance account can turn an ordinary upload feature into a post-compromise route. Review which accounts can use upload functions, where the management interface is reachable, and whether unexpected web-directory changes appear in preserved logs. Do not validate by uploading or executing test payloads on operational equipment.

Session lifetime and log identifiers

CVE-2026-14948 affects 2.13.0 through 2.13.3 and exposes plaintext session identifiers in downloadable error logs. A low-privileged user with log access could use another user's identifier to hijack that session. CVE-2026-14950 affects 2.1.0 through 2.13.3 and allows expired session identifiers to remain usable, permitting continued unauthenticated access when a previous token has been obtained.

A password reset alone may not close a server-side session weakness. After the official update, invalidate active sessions, review administrative credentials, and confirm that login and logout behave correctly. Limit error-log access to authorized operators and handle exported logs as sensitive material because they may contain authentication-related values.

Authorization and forged requests

CVE-2026-14949 affects 2.11.0 through 2.13.3 and lets a low-privileged user create accounts with arbitrary roles. CVE-2026-14951 affects 2.0.0 through 2.13.3 and permits cross-site request forgery that can cause an authenticated user to perform an unintended action. CVE-2026-14953 affects 2.11.0 through 2.13.3 and allows low-privileged users to enumerate other users and privilege levels.

Together, these issues expose the relationship between account inventory, role assignment, and administrator browser sessions. Reconcile configured users with named operators, remove stale accounts, reduce excessive roles, and perform administration only from trusted systems on a controlled management network.

Backup and configuration exposure

CVE-2026-14952 affects 2.0.0 through 2.13.3 and allows unauthenticated access to backup and download files. The official description notes that these files may contain railway signaling information and track-layout data. This path therefore requires attention to network boundaries, storage locations, reverse-proxy or firewall controls, and preserved access logs—not only account passwords.

Affected releases and the official update

The affected ranges are 2.8.0–2.13.3 for CVE-2026-14946 and CVE-2026-14947; 2.13.0–2.13.3 for CVE-2026-14948; 2.11.0–2.13.3 for CVE-2026-14949 and CVE-2026-14953; 2.1.0–2.13.3 for CVE-2026-14950; and 2.0.0–2.13.3 for CVE-2026-14951 and CVE-2026-14952. The official corrected release is FDS102 2.14.0.

Use read-only inventory sources to confirm the deployed version and obtain update material through an authorized vendor channel. Plan a maintenance window, preserve approved configuration backups, and confirm recovery procedures before changing operational equipment. Afterward, validate sessions, roles, log and backup access, and normal diagnostic functions. Follow the vendor and the organization's rollback plan if validation fails.

Management-network boundaries

CERT@VDE recommends restricting FDS102 access to authorized personnel and connecting it to an EN 50159 category 2 network. Category 3 connectivity requires additional protective measures. In practice, keep the management interface off the public internet and general business networks, use controlled administration paths, and apply individual identities, strong authentication, time-bounded access, and session logging for remote maintenance.

Operator checklist

1. Confirm the FDS102 model and installed release through read-only inventory or the management interface.
2. Check whether the web interface is reachable from the internet or a general business network and restrict it to the approved management path.
3. Reconcile configured accounts with named operators and remove stale, shared, or over-privileged access.
4. Restrict error-log and backup downloads, and preserve evidence of unusual access.
5. Obtain FDS102 2.14.0 through the official support channel and approve the maintenance, backup, and recovery plan.
6. After updating, invalidate sessions and validate login, logout, roles, logs, backups, and diagnostic functions.

The practical lesson is not to memorize eight CVE numbers. File handling, sessions, authorization, and sensitive downloads converge on one web management surface. Apply the vendor update and strengthen the access boundary together, using approved operational procedures rather than exploit reproduction or intrusive scanning.