{"id":"CVE-2026-14950","state":"PUBLISHED","title":"Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logic","description":"An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.","publishedAt":"2026-08-20T08:19:26.334Z","updatedAt":"2026-08-20T15:26:26.910Z","severity":{"score":9.2,"label":"Critical","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","source":"CERTVDE"},"assigner":"CERTVDE","products":["Frauscher Sensortechnik FDS 102"],"affected":[{"vendor":"Frauscher Sensortechnik","product":"FDS 102","defaultStatus":"unaffected","versions":[{"version":"2.1.0","status":"affected","lessThanOrEqual":"2.13.3","versionType":"semver"}]}],"references":["https://www.certvde.com/en/advisories/VDE-2026-078/"],"weaknesses":["CWE-613"],"ingestedAt":"2026-10-29T20:11:00.674Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/14xxx/CVE-2026-14950.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-14950","state":"PUBLISHED","datePublished":"2026-08-20T08:19:26.334Z","dateUpdated":"2026-08-20T15:26:26.910Z","assignerShortName":"CERTVDE","assignerOrgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateReserved":"2026-07-07T12:46:59.328Z"},"containers":{"cna":{"title":"Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logic","descriptions":[{"lang":"en","value":"An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface."}],"affected":[{"vendor":"Frauscher Sensortechnik","product":"FDS 102","defaultStatus":"unaffected","versions":[{"version":"2.1.0","status":"affected","lessThanOrEqual":"2.13.3","versionType":"semver"}]}],"references":[{"url":"https://www.certvde.com/en/advisories/VDE-2026-078/"}],"metrics":[{"cvssV4_0":{"Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","Safety":"NOT_DEFINED","attackComplexity":"LOW","attackRequirements":"PRESENT","attackVector":"NETWORK","baseScore":9.2,"baseSeverity":"CRITICAL","privilegesRequired":"NONE","providerUrgency":"NOT_DEFINED","subAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","userInteraction":"NONE","valueDensity":"NOT_DEFINED","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0","vulnAvailabilityImpact":"HIGH","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnerabilityResponseEffort":"NOT_DEFINED"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.8,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","description":"CWE-613 Insufficient Session Expiration","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"CERTVDE","orgId":"270ccfa6-a436-4e77-922e-914ec3a9685c","dateUpdated":"2026-08-20T08:19:26.334Z"},"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:frauscher_sensortechnik:fds_102:*:*:*:*:*:*:*:*","versionEndIncluding":"2.13.3","versionStartIncluding":"2.1.0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"source":{"advisory":"VDE-2026-078","defect":["CERT@VDE#642157"],"discovery":"UNKNOWN"},"x_generator":{"engine":"Vulnogram 0.4.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-14950","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-08-20T15:03:21.438732Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-08-20T15:26:26.910Z"}}]}}}