CVE-2026-14950
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
An unauthenticated remote attacker with a valid session identifier can continue using the session after expiration. This increases risks associated with stolen or shared sessions and may enable unauthorized continued access to the FDS web interface.
Risk Assessment
The risk includes prolonged unauthorized access to the FDS system, potentially leading to data confidentiality and integrity breaches.
Recommendation
Implement server-side session expiration enforcement and regularly invalidate sessions after logout.
Other vulnerabilities in FDS
See all- CVE-2026-14952High
An unauthenticated remote attacker can retrieve sensitive files from the FDS Web server, such as the backup archive at `/FdsBackup.zip` and files under `/downloads/*`, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information.
- CVE-2026-14951High
A low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.
Original NVD description (English source)
An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web interface.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS