Threats Tagged 'cve-2026-14948'

CVE-2026-14948 is a high-severity vulnerability that allows a low privileged remote attacker to hijack an active administrative session without knowing the administrator password. The attacker can extract live plaintext session identifiers from downloadable error log archives, enabling unauthorized access to authenticated sessions.

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives.

Successful exploitation of these vulnerabilities could allow attackers to execute arbitrary code on the FDS102 web server, write files to arbitrary server locations, hijack active administrative sessions, create privileged user accounts, perform unauthorized actions, access sensitive railway signalling and track layout information, and enumerate user accounts and privilege levels. The impact depends on the affected version and attacker privileges, but the combined issue set affects confidentiality, integrity, and availability of the FDS102 web interface and underlying system.