CVE-2026-14950: Frauscher Sensortechnik: FDS102 for FAdC/FAdCi R2 is vulnerable to Insufficient Session Expiration due to flawed session expiration logic
An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker must possess a valid session identifier. No authentication or user interaction is required once the attacker has that identifier, and the session can continue to be used after it should have expired.
Which situations create the greatest exposure?
Stolen, leaked, shared, or unattended sessions are specifically at risk. Any user whose valid session identifier is obtained by an unauthenticated remote attacker may be subject to unauthorized continued access to the FDS web interface.
What access could continued use of an expired session provide?
The issue may allow unauthorized continued access to the FDS web interface. The vulnerability is rated critical with impacts to confidentiality, integrity, and availability.