Executive Summary

A critical vulnerability, CVE-2026-14950, with a CVSS score of 9.8, affects Frauscher Sensortechnik's FDS 102 product. This session fixation vulnerability allows an unauthenticated remote attacker to continue using a valid session after it has expired, potentially leading to unauthorized access to the FDS web interface. The vulnerability impacts versions 2.1.0 through 2.13.3 of the FDS 102 product.

Technical Analysis

CVE-2026-14950 is a session fixation vulnerability. The root cause of this vulnerability is the improper handling of session expiration. An attacker can exploit this vulnerability by possessing a valid session identifier that has not been properly terminated after its expiration. This allows the attacker to continue using the session, potentially gaining unauthorized access to the FDS web interface.

How It Gets Exploited

An unauthenticated remote attacker who possesses a valid session identifier can continue to use the session even after it has expired. Here's a realistic exploitation scenario:

  • The attacker obtains a valid session identifier through various means (e.g., stealing, leaking, or sharing).
  • The session expires according to the system's session management policy.
  • Despite the session expiration, the attacker can continue to use the session identifier to access the FDS web interface.
  • The attacker achieves unauthorized continued access to the FDS web interface, potentially leading to further exploitation or data access.

Impact Assessment

The vulnerability affects Frauscher Sensortechnik's FDS 102 product, specifically versions 2.1.0 through 2.13.3. An attacker can achieve unauthorized continued access to the FDS web interface, potentially leading to confidentiality, integrity, and availability impacts. The CVSS score of 9.8 indicates a critical severity level.

Recommended Actions

  • Update FDS 102 to version 2.13.4 or later.
  • Implement proper session management practices, including secure session termination and regeneration of session identifiers upon authentication.
  • Monitor and restrict access to sensitive areas of the FDS web interface.
  • Consider implementing additional security measures, such as multi-factor authentication or IP restrictions, to further mitigate the risk.

Sources

  • National Vulnerability Database (NVD) - CVE-2026-14950
  • Frauscher Sensortechnik - FDS 102 documentation and security advisories
  • CERT VDE - VDE-2026-078 advisory