Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to…

CVE-2026-14950 is an insufficient session expiration flaw in the Frauscher FDS102 Diagnostic System for FAdC/FAdCi R2 (versions 2.0.0 through 2.13.3). Once a user authenticates to the FDS102 web interface, their session token remains valid indefinitely — or far beyond any reasonable timeout — even after logout or expected expiry. An attacker who obtains a valid session identifier can hijack the session and interact with the railway axle-counting diagnostic system as an authenticated user, with whatever privilege level that session holds. The fix is FDS102 v2.14.0, released alongside advisory VDE-2026-078 on 2026-08-20.

The vendor's CVSS:4.0 score of 9.2 and CERT@VDE's CVSS:3.1 score of 9.8 are overscored for this CVE in isolation — session expiration is a chain enabler, not a standalone exploit. You need a valid session token first. However, CVE-2026-14950 was disclosed alongside seven companion CVEs (VDE-2026-078) affecting the same version range, including CVE-2026-14948 (session IDs leaked in downloadable error logs) and CVE-2026-14952 (unauthenticated access to /FdsBackup.zip and /downloads/). Together, these create a fully unauthenticated chain from network access to persistent admin control of a safety-critical railway system. The ICS/OT context — 100% of FDS102 installs are in railway environments — makes this a CRITICAL floor despite the standalone friction. noisgate downgrades the score from 9.2 to 8.5 to reflect the chain-dependency, but holds the CRITICAL verdict because of the OT-safety blast radius.

Why this verdict

• Chain dependency lowers standalone score: CVE-2026-14950 alone is a session expiration flaw — it extends access windows but does not grant initial access. This justifies dropping from the vendor's 9.2/9.8 to 8.5. The CVSS:3.1 PR:N rating is misleading for this specific CWE.
• Companion CVEs complete the chain unauthenticated: CVE-2026-14952 (unauthenticated file download) + CVE-2026-14948 (session IDs in logs) + CVE-2026-14950 (no expiry) = fully unauthenticated persistent access. All share the same affected version range (v2.0.0–v2.13.3) and fix (v2.14.0). In practice, any unpatched FDS102 has all eight vulnerabilities.
• Role multiplier: OT-safety floor = CRITICAL. The FDS102 is *exclusively* deployed as a railway ICS diagnostic system for axle-counting controllers (FAdC/FAdCi). 100% of the installed base occupies the high-value OT/ICS/SCADA role. Compromise of the diagnostic interface can disrupt train detection data, potentially affecting signaling safety functions. Even though the FAdC controllers themselves are SIL4-rated with independent fail-safes, the diagnostic system is a trusted management plane — its compromise represents a credible OT-safety impact vector. This floors the verdict at CRITICAL.
• Network segmentation provides friction but does not break the floor: Vendor guidance mandates Category 2 (closed operational) network placement per EN 50159:2010, and no internet-exposed instances appear on Shodan/Censys. However, OT/IT segmentation quality varies widely across railway operators, and internal network access (post-initial-compromise of corporate IT) is a realistic attacker position for nation-state and advanced criminal actors targeting transportation infrastructure. Generic 'requires internal access' is insufficient to break the CRITICAL floor for a canonical ICS component.

Why not higher?

The score is already at the CRITICAL tier. A 9.2+ score would be appropriate if this were a standalone unauthenticated RCE — but CVE-2026-14950 is specifically a session expiration flaw that requires companion CVEs to form a complete chain. The AT:P (Attack Prerequisites) in the CVSS:4.0 vector correctly reflects this dependency. The 8.5 score accurately represents a critical-tier chain component rather than a standalone critical exploit.

Why not lower?

Downgrading below CRITICAL would require evidence that fewer than 1% of FDS102 installs occupy OT-safety roles — but 100% of them do by definition. The companion CVE chain (CVE-2026-14952 → CVE-2026-14948 → CVE-2026-14950) removes the 'requires prior authentication' friction that would normally justify a HIGH rating for a session expiration flaw. The railway/ICS context means the blast radius is not 'one web app tenant' but 'train detection and signaling safety for a rail corridor.'

1. Isolate FDS102 to Category 2 network immediately — If FDS102 is reachable from corporate IT or any non-OT VLAN, move it behind a unidirectional gateway or dedicated OT firewall with explicit allow-lists. This is the single highest-leverage control. Deploy within 3 days per noisgate mitigation SLA for CRITICAL.
2. Restrict web interface access to named admin workstations — Configure host-based or network-level ACLs to permit FDS102 web interface access only from specific, hardened OT admin jump hosts. This limits the attacker's ability to reach the interface even from within the OT network. Deploy within 3 days.
3. Rotate all FDS102 user credentials and force re-authentication — Since sessions don't expire properly, invalidate all existing sessions by resetting user accounts. This burns any harvested tokens. Repeat weekly until v2.14.0 is deployed.
4. Monitor for unauthenticated file downloads — Alert on HTTP requests to /FdsBackup.zip, /downloads/, and error log endpoints from any source. These are indicators of CVE-2026-14952 exploitation, which is the entry point for the session-harvesting chain.
5. Apply FDS102 v2.14.0 — The definitive fix. Addresses all 8 CVEs in VDE-2026-078. Coordinate with Frauscher and your railway signaling integrator for validated deployment. Target within 90 days per noisgate remediation SLA for CRITICAL.

Run this script from an OT admin workstation that has HTTP(S) access to the FDS102 web interface. Invoke with: bash check_fds102_session.sh <FDS102_IP_OR_HOSTNAME>. No authentication required — it checks the firmware version via the web interface. Requires curl and network access to the target.

#!/bin/bash
# check_fds102_session.sh — Check FDS102 firmware version for CVE-2026-14950
# Usage: bash check_fds102_session.sh <FDS102_HOST>
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

HOST="${1:-}"
if [ -z "$HOST" ]; then
  echo "Usage: $0 <FDS102_HOST>"
  exit 2
fi

echo "[*] Checking FDS102 at $HOST for CVE-2026-14950 (CWE-613)..."

# Attempt to retrieve version info from the web interface
RESPONSE=$(curl -sk --connect-timeout 10 --max-time 15 "https://$HOST/" 2>/dev/null || curl -sk --connect-timeout 10 --max-time 15 "http://$HOST/" 2>/dev/null || true)

if [ -z "$RESPONSE" ]; then
  echo "[!] Could not connect to FDS102 at $HOST"
  echo "UNKNOWN"
  exit 2
fi

# Try to extract version string (common patterns in FDS102 web UI)
VERSION=$(echo "$RESPONSE" | grep -oP '(?:FDS102|version|Version|fw_version)[^0-9]*\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)

if [ -z "$VERSION" ]; then
  # Try alternative version endpoint
  ALT_RESPONSE=$(curl -sk --connect-timeout 10 --max-time 15 "https://$HOST/api/system/info" 2>/dev/null || curl -sk --connect-timeout 10 --max-time 15 "http://$HOST/api/system/info" 2>/dev/null || true)
  VERSION=$(echo "$ALT_RESPONSE" | grep -oP '"version"\s*:\s*"\K[0-9]+\.[0-9]+\.[0-9]+' | head -1)
fi

if [ -z "$VERSION" ]; then
  echo "[!] Could not determine FDS102 firmware version"
  echo "UNKNOWN"
  exit 2
fi

echo "[*] Detected FDS102 firmware version: $VERSION"

# Compare version — vulnerable: 2.0.0 through 2.13.3, fixed: 2.14.0+
MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

if [ "$MAJOR" -lt 2 ]; then
  echo "[!] Version $VERSION is below affected range (< 2.0.0) — verify manually"
  echo "UNKNOWN"
  exit 2
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -lt 14 ]; then
  echo "[!!] VULNERABLE — FDS102 $VERSION is affected by CVE-2026-14950"
  echo "     Affected range: v2.0.0 through v2.13.3"
  echo "     Fix: upgrade to v2.14.0 or later"
  echo "VULNERABLE"
  exit 1
elif [ "$MAJOR" -eq 2 ] && [ "$MINOR" -eq 14 ] && [ "$PATCH" -ge 0 ]; then
  echo "[+] PATCHED — FDS102 $VERSION is v2.14.0 or later"
  echo "PATCHED"
  exit 0
elif [ "$MAJOR" -gt 2 ] || ([ "$MAJOR" -eq 2 ] && [ "$MINOR" -gt 14 ]); then
  echo "[+] PATCHED — FDS102 $VERSION is beyond v2.14.0"
  echo "PATCHED"
  exit 0
else
  echo "[?] Could not determine patch status for version $VERSION"
  echo "UNKNOWN"
  exit 2
fi

Sources

1. CERT@VDE Advisory VDE-2026-078
2. CERT@VDE Frauscher Advisories Index
3. Frauscher PSIRT Page
4. SecurityOnline — Critical Frauscher Flaws
5. INCIBE-CERT — Frauscher Vulnerabilities
6. Frauscher IEC 62443-4-1 Certification
7. GitHub Advisory — CVE-2022-3575 (prior FDS102 vuln)