CVE-2026-14948: CWE-532 Insertion of Sensitive Information into Log File in Frauscher Sensortechnik FDS 102

This vulnerability (CWE-532) in Frauscher Sensortechnik FDS 102 affects versions 2.13.0 to 2.13.3. It permits a remote attacker with low privileges to hijack an active administrative session by accessing error log archives that contain live plaintext session identifiers for authenticated users. The attacker does not require the administrator password to perform this hijacking. The CVSS 4.0 score is 8.7, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts confidentiality, integrity, and availability with high impact.

An attacker can gain unauthorized administrative access by hijacking an active session through extraction of live session identifiers from error logs. This compromises the confidentiality and integrity of the administrative session and potentially the entire system managed by FDS 102. The attacker does not need the administrator password, increasing the risk of unauthorized control.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, restrict access to error log archives to trusted users only and monitor for unauthorized downloads. Avoid exposing error logs publicly or to low privileged users.