Summary
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are prone to multiple vulnerabilities which could lead up to a full compromise of the FDS101 device.
Details
Impact
Please consult the CVE Entries above.
Mitigation
Security-related application conditions SecRAC
The railway operator must ensure that only authorised personnel or people in the company of authorised personnel have access to the Frauscher Diagnostic System FDS101.
The recommendation is to connect the Frauscher Diagnostic System FDS101 to a network of category 2.
If the Frauscher Diagnostic System FDS101 is connected to a network of category 3 (according to EN 50159:2010), then additional protective measures must be added.
Remediation
Update to FDS102 v2.10.1
Vulnerabilities 3
-
Critical 9.8
Frauscher FDS101 for FAdC/FAdCi remote code execution vulnerability
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a remote code execution (RCE) vulnerability via manipulated parameters of the web interface without authentication. This could lead to a full compromise of …
-
High 7.5
Frauscher FDS101 for FAdC/FAdCi path traversal vulnerability
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a path traversal vulnerability of the web interface by a crafted URL without authentication. This enables an remote attacker to read all files on the filesy…
-
Medium 5.3
Frauscher FDS101 for FAdC/FAdCi SQL injection vulnerability
Frauscher Sensortechnik GmbH FDS101 for FAdC/FAdCi v1.4.24 and all previous versions are vulnerable to a SQL injection vulnerability via manipulated parameters of the web interface without authentication. The database contains limited, non-critical log inform…
Revision history
-
#1
Initial revision.
References
-
VDE-2023-038: Frauscher: Multiple Vulnerabilities in FDS101 - HTML
https://certvde.com/en/advisories/VDE-2023-038/
-
Vendor PSIRT
https://www.frauscher.com
-
CERT@VDE Security Advisories for Frauscher Sensortechnik GmbH
https://certvde.com/en/advisories/vendor/frauscher/