CVE-2026-14952
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
An unauthenticated remote attacker can retrieve sensitive files from the FDS Web server, such as the backup archive at `/FdsBackup.zip` and files under `/downloads/*`, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information.
Risk Assessment
The risk includes exposure of sensitive railway infrastructure information, which could be used for physical or cyber attacks.
Recommendation
Immediately secure these files, require authentication, and restrict directory access.
Other vulnerabilities in FDS
See all- CVE-2026-14950Critical
An unauthenticated remote attacker with a valid session identifier can continue using the session after expiration. This increases risks associated with stolen or shared sessions and may enable unauthorized continued access to the FDS web interface.
- CVE-2026-14951High
A low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web pages.
Original NVD description (English source)
An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be available to unauthenticated users.