CVE-2026-14951: CWE-352 Cross-Site Request Forgery (CSRF) in Frauscher Sensortechnik FDS 102

CVE-2026-14951 is a CWE-352 Cross-Site Request Forgery vulnerability in Frauscher Sensortechnik's FDS 102 product. It enables a remote attacker with low privileges to cause authenticated users to execute unintended commands on the FDS Web interface by leveraging malicious web content. The CVSS 4.0 base score is 8.6, indicating high severity, with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. The affected versions are from 2.0.0 up to and including 2.13.3.

Successful exploitation can lead to unauthorized actions performed by authenticated users without their intent, potentially compromising system integrity and availability. The attacker does not need elevated privileges but relies on user interaction with crafted web content. Confidentiality, integrity, and availability impacts are all rated high by the CVSS vector.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when interacting with untrusted web content while authenticated to the FDS 102 interface. Implementing CSRF protections such as anti-CSRF tokens and validating request origins on the server side is recommended if possible.