Insufficient Session Expiration in Frauscher Sensortechnik FDS 102

CVE-2026-14950 identifies an insufficient session expiration flaw (CWE-613) within the web interface of the Frauscher Sensortechnik FDS 102 system, affecting versions 2.1.0 through 2.13.3. This vulnerability enables an unauthenticated attacker who has obtained a valid session identifier - potentially through interception, theft, or by leveraging an unattended machine - to continue using the session indefinitely, even after the system's expiration policy should have terminated it. This persistence mechanism allows unauthorized users to maintain an active, authenticated state, effectively bypassing standard session timeout security controls. Defenders should prioritize patching affected FDS 102 units and implement strict monitoring for anomalous session activity or unauthorized session token reuse.

Impact

The vulnerability carries a CVSS v3.1 score of 9.8 (Critical), indicating high risk for unauthorized access and control over the affected FDS 102 interface. If exploited, an attacker gains persistent access to the management environment, potentially leading to unauthorized monitoring or configuration changes of sensitive industrial sensor systems. The vulnerability affects a critical component of industrial infrastructure management, and failure to apply available patches leaves systems open to prolonged unauthorized access.

Recommendation

• Apply the security update provided by Frauscher Sensortechnik to all FDS 102 instances running version 2.13.3 or earlier to remediate CVE-2026-14950.
• Monitor web application logs for session tokens that persist beyond expected operational windows or show abnormal temporal patterns.
• Enforce strict session management policies, including idle timeouts and secure transport (HTTPS) to mitigate the risk of session identifier interception.