CVE-2026-14953 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

CVE-2026-14953 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is Missing Authorization due to improper enforcement of role-based access control

A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint /api/user/fetch-all.php...

CVE-2026-14953

Frauscher Sensortechnik's FDS102 device (R2) has improper RBAC enforcement at /api/user/fetch-all.php, allowing a low-privileged remote attacker to enumerate all users and identify privileged accounts (CVSS 5.3 MEDIUM). No patch version or in-the-wild exploitation details are provided in the docu...

CVE-2026-14952

Frauscher's FDS102 web server exposes sensitive railway signaling and track layout data — including /FdsBackup.zip and files under /downloads/* — without authentication over HTTP. CVSS 8.7 (HIGH) reflects high confidentiality impact; no integrity or availability effects. No patch or workaround is...

CVE-2026-14952 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is offering files with sensitive information for download without requiring authentication

An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information tha...

CVE-2026-14951 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14951 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Cross-Site Request Forgery due to missing CSFR protection headers

An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages...

CVE-2026-14951

The FDS Web interface of FDS102 firmware for FAdC/FAdCi R2 lacks CSRF protection headers, allowing a low-privileged remote attacker to trick authenticated users into executing unintended actions via malicious web pages. Exploitation details are not provided; refer to the VDE-2026-078 advisory for...

CVE-2026-14950 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logic

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...

CVE-2026-14950

FDS102 for FAdC/FAdCi R2 has flawed session expiration logic: a stolen or leaked session identifier remains valid after its intended expiry, enabling continued unauthorized access to the FDS web interface. CVSS 9.8 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No patch or exploit detai...

CVE-2026-14949 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access control

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application...

CVE-2026-14949

Frauscher Sensortechnik's FDS102 system (for FAdC/FAdCi R2) exposes an unauthenticated /api/user/add.php endpoint that accepts arbitrary role values; a low-privileged attacker with a valid session can create accounts at the highest privilege level, enabling privilege escalation. CVSS 3.1 scores t...

CVE-2026-14949 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Incorrect Authorization due to improper enforcement of role-based access control

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application...

CVE-2026-14948 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insertion of Sensitive Information into Log File via error log archives

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives...

CVE-2026-14948

FDS102 for FAdC/FAdCi R2 logs plaintext session identifiers into downloadable error log archives, allowing a low-privileged remote attacker to hijack admin sessions without credentials. No patch or exploitation evidence is provided; see VDE-2026-078 advisory.

CVE-2026-14947 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious ZIP file

A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the intended extraction directory and write files to arbitrary locations on the server, potentially achieve arbitrary code execution due to improper validation of...

CVE-2026-14947

FDS102 for FAdC/FAdCi R2 by Frauscher Sensortechnik fails to validate ZIP entry paths, allowing a high-privileged remote attacker to inject directory traversal sequences (../) and write files to arbitrary locations, potentially achieving arbitrary code execution and full system compromise. CVSS 3...

CVE-2026-14946 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

CVE-2026-14946 Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Remote Code Execution via malicious configuration file.

A high privileged remote attacker can upload a .php file and then request it directly from /uploads/.php to achieve arbitrary code execution due to improper file type validation which could result in full system compromise...

CVE-2026-14946

Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2 is vulnerable to remote code execution due to improper file type validation . A high-privileged remote attacker can upload a .php file and then request it directly from /uploads/.php, leading to arbitrary code execution and potential full system co...