Skip to content
OpenAdvisories
Critical VDE-2025-030 2 CVEs

Frauscher: FDS101, FDS-SNMP101 and FDS102 for FAdC/FAdCi are Vulnerable to OS Command Injection Vulnerability

Published Jul 7, 2025 · Updated Jul 29, 2025 · Revision 2

Vendor: Frauscher Product: 101 Product: 102 Product: SNMP101

Summary

Frauscher Sensortechnik FDS101, FDS-SNMP101 and FDS102 for FAdC/FAdCi R2 and all previous versions are vulnerable to OS Command Injection via malicious configuration file.

CVE-2025-3626 affects FDS102 versions v2.8.0 < v2.13.3.

CVE-2025-3705 affects a broader range of products and versions. Specifically, it affects:
* FDS102 versions < v2.13.3
* FDS101 versions <= v1.4.25
* FDS-SNMP101 versions <= v.2.3.9

**Update 1.1.0, 29.07.2025:** The summary has been updated to include a mapping between CVEs and affected products, and the remediation section has been revised to include FDS101.

Details

Impact
This enables a remote or a local attacker to gain full control of the FDS101/FDS-SNMP101/FDS102 device.

Mitigation
Security-related application conditions SecRAC:

* The railway operator must ensure that only authorised personnel or people in the company of
authorised personnel have access to the Frauscher Diagnostic System FDS101/FDS-SNMP101/FDS102. This applies for both vulnerabilities.

* The recommendation is to connect the Frauscher Diagnostic System FDS102 to a network of category 2. If the Frauscher Diagnostic System FDS102 is connected to a network of category 3
(according to EN 50159:2010), then additional protective measures must be added. This applies for CVE-2025-3626.

Remediation
Update FDS101 or FDS102 to FDS102 v2.13.3 or higher.

Vulnerabilities 2

  • Critical 9.1
    CVE-2025-3626

    OS Command Injection via Config Upload in WebUI

    A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') while uploading a config file via webUI.

    Frauscher FDS102
  • Medium 6.8
    CVE-2025-3705

    OS Command Injection via USB Config Load

    A physical attacker with no privileges can gain full control of the affected device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') when loading a config file from a USB drive.

    Frauscher FDS102 FDS101 FDS-SNMP101

Revision history

  1. #1.1.0

    The summary has been updated to include a mapping between CVEs and affected products, and the remediation section has been revised to include FDS101.

  2. #1.0.0

    Initial revision

References