A critical session-expiration weakness in Frauscher Sensortechnik's FDS 102 lets a remote attacker holding a valid session identifier keep using that session long after it should have been invalidated.
What Is It
CVE-2026-14950 is an insufficient session expiration flaw (CWE-613) disclosed by CERT@VDE on 20 August 2026. A remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired, granting unauthorized continued access to the FDS web interface.
The vendor rates it CVSS v3.1 9.8 CRITICAL (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), with a CVSS v4.0 score of 9.2 CRITICAL. Attack vector is network and complexity is low, and confidentiality, integrity, and availability impact are all rated HIGH.
Read the v3.1 vector with a caveat. PR:N means the attacker does not authenticate to the application as part of the attack; which is literally true, since the flaw is that an already-issued session identifier keeps working. But the attack is not something an arbitrary internet host can launch against an unprepared target: it presupposes that a valid session identifier has already been issued and has fallen into the attacker's hands. That precondition sits outside what the v3.1 metrics model, which is part of why the score lands at 9.8. The v4.0 vector captures it explicitly.
Why It Matters
The vulnerability turns any session identifier that leaks, stolen, shared, or left behind on an unattended workstation, into durable access. Normally, session timeouts bound the window in which a captured token is useful; here that bound does not hold. The CVE record explicitly notes this increases the risk associated with stolen, leaked, shared, or unattended sessions.
The v4.0 vector sets Attack Requirements to PRESENT, reflecting that the attacker must first obtain a valid session identifier. Based on the published record, that appears to be the primary gate: token acquisition is the hard part, and once a token is in hand, no further authentication step is described as standing in the way. That shapes the defensive picture; controls that limit token exposure (shared or unattended operator workstations, session identifiers in logs or URLs, network capture on the management segment) are doing more work here than perimeter controls aimed at unauthenticated network reachability.
What's Vulnerable
- Vendor: Frauscher Sensortechnik
- Product: FDS 102
- Affected versions: 2.1.0 through 2.13.3 (semver range, inclusive)
- Default status for other versions: unaffected
No CPE entries were published with the record at time of writing.
Patch Status
The NVD record carries a vulnStatus of Received and lists no patched version, mitigation, or vendor fix. Refer to CERT@VDE advisory VDE-2026-078 for remediation guidance.
As of publication, CVE-2026-14950 does not appear in the CISA Known Exploited Vulnerabilities catalog. There is no publicly reported active exploitation and no KEV-mandated remediation deadline currently associated with this CVE. Exploit maturity in the CVSS v4.0 vector is NOT_DEFINED. The KEV catalog is updated continuously, so readers should confirm current status directly.
Sources
- NVD, CVE-2026-14950: https://nvd.nist.gov/vuln/detail/CVE-2026-14950
- CERT@VDE Advisory VDE-2026-078: https://www.certvde.com/en/advisories/VDE-2026-078/
- CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog