This vulnerability (CVE-2026-14952) enables an unauthenticated remote attacker to access sensitive files on the FDS Web server without requiring a valid session. Specifically, the attacker can download the backup archive located at /FdsBackup.zip and other files under the /downloads/ path. The exposed files contain critical railway signaling and track layout data, which are sensitive and should not be accessible without proper authorization. The vulnerability is classified under CWE-306 (Missing Authentication for Critical Function). The CVSS 3.1 base score is 7.5, reflecting high severity due to the network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact with no integrity or availability impact.

The vulnerability allows unauthorized disclosure of sensitive railway infrastructure information, which could facilitate further attacks or disruptions if leveraged by malicious actors. The confidentiality of critical operational data is compromised, potentially impacting railway safety and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the FDS Web server and sensitive file locations via network controls such as firewalls or VPNs. Monitor for unauthorized access attempts and consider disabling or securing the /FdsBackup.zip and /downloads/ endpoints to prevent unauthenticated retrieval.