Description
An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be available to unauthenticated users.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Frauscher Sensortechnik | FDS 102 | 2.1.0 – ≤ 2.13.3 | — |
Advisories 1
- VDE-2026-078 Frauscher: FDS102 for FAdC/FAdCi R2 has multiple vulnerabilities CERT@VDE · Aug 20, 2026