CVE-2026-14951
HighCVSS 8.0Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
A low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.
Risk Assessment
The risk includes potential CSRF attacks, leading to unauthorized changes in the FDS system.
Recommendation
Implement CSRF protections such as tokens and educate users on safe browsing.
Other vulnerabilities in FDS
See all- CVE-2026-14950Critical
An unauthenticated remote attacker with a valid session identifier can continue using the session after expiration. This increases risks associated with stolen or shared sessions and may enable unauthorized continued access to the FDS web interface.
- CVE-2026-14952High
An unauthenticated remote attacker can retrieve sensitive files from the FDS Web server, such as the backup archive at `/FdsBackup.zip` and files under `/downloads/*`, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information.
Original NVD description (English source)
An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.