CVE-2026-14946 matters because it can turn a specialized diagnostic system into a foothold for an attacker to run commands, access sensitive information, or disrupt operations. The flaw affects Frauscher Sensortechnik FDS102 systems used with FAdC and FAdCi axle-counting equipment, so organizations in rail, transit, industrial operations, and critical infrastructure should pay particular attention.frauscher
If your business operates, maintains, integrates, or provides security oversight for these systems, this is not merely an IT patching task. A successful exploit could affect the availability and integrity of operational technology environments. This post explains the business risk, helps you determine whether you are exposed, and provides practical response steps. A technical appendix gives security engineers and penetration testers the details needed for detection, verification, and remediation.
Frauscher published its product security advisory for CVE-2026-14946 on August 20, 2026. The National Vulnerability Database listed the issue the same day and last modified its entry on September 3, 2026.
The affected product is FDS102 for FAdC/FAdCi R2, versions 2.8.0 through 2.13.3 inclusive. The weakness is an unrestricted upload of a file with a dangerous type, classified as CWE-434. In practical terms, the system fails to properly validate the type of file being uploaded, allowing a privileged user to upload a PHP file that can later be requested and executed.frauscher+1
The vendor assigns the issue a CVSS v4.0 base score of 8.6, while NVD records a CVSS v3.1 base score of 7.2. Both ratings place it in the high-severity category. The vulnerability was disclosed through Frauscher’s PSIRT advisory, VDE-2026-078, which also covers related FDS102 issues.
For a business, the central risk is loss of control over a system that should be isolated, monitored, and trustworthy. An attacker who obtains high-privileged access to an affected FDS102 interface could upload and execute malicious code, potentially gaining broad control of the device and its surrounding environment.
Operational impact may include interrupted diagnostics, unreliable system data, unauthorized configuration changes, or the need to take equipment offline for investigation and recovery. In rail and industrial settings, even a short disruption can affect maintenance schedules, incident response, safety assurance activities, and coordination with operators or regulators.
Data risk is also significant. Compromised diagnostic or operational systems may expose network details, credentials, configuration information, logs, or information about connected infrastructure. That information can support further attacks, including lateral movement into corporate or operational networks.
Reputational and contractual consequences can follow. Customers, partners, and regulators may expect evidence that critical systems were patched promptly, access was controlled, and incidents were handled according to established procedures. For organizations subject to critical-infrastructure, transportation, or industrial-security requirements, an unaddressed high-severity vulnerability in an internet-reachable or broadly connected system can create audit and compliance exposure.
Regional rail operator: A regional rail operator uses FDS102-based diagnostics to monitor axle-counting equipment across several lines. If an attacker compromises an affected system, the operator may lose confidence in diagnostic data, delay maintenance decisions, and spend unplanned time isolating and rebuilding affected devices.
Transit maintenance contractor: A contractor manages diagnostic platforms for multiple transit customers. A compromise in one customer environment could raise concerns about cross-client access, contractual security obligations, and the contractor’s ability to demonstrate that customer systems remain protected.
Industrial facility with rail-connected logistics: A manufacturing or logistics site relies on rail-linked operations and uses specialized monitoring systems around its rail infrastructure. An attacker could use compromised diagnostic equipment as a starting point to map the network, harvest credentials, or interfere with systems that support scheduling and operational visibility.
Mid-sized managed service provider: A provider responsible for remote monitoring of customer infrastructure may not own the rail equipment directly but could be accountable for network segmentation, patch coordination, and incident response. Failure to identify and remediate the vulnerable version could result in service-level issues, customer escalation, and reputational damage.
If you operate FDS102 systems or cannot yet confirm whether they are exposed, treat this as a priority risk-reduction activity. IntegSec can help you validate exposure, test the effectiveness of your controls, and identify weaknesses before an attacker does. Visit https://integsec.com to discuss a penetration test and a practical plan for reducing cybersecurity risk across your environment.
CVE-2026-14946 is an unrestricted upload of a file with a dangerous type in Frauscher Sensortechnik FDS102 for FAdC/FAdCi R2. The affected versions are 2.8.0 through 2.13.3, and the vendor remediation is version 2.14.0 or later.
The root cause is improper file-type validation in the web-facing upload functionality. A remote attacker with high privileges can upload a file with a .php extension through the web user interface. The uploaded file is then reachable at /uploads/<filename>.php; requesting it causes the web server to execute the file, resulting in arbitrary code execution.
The attack vector is network-based, attack complexity is low, privileges required are high, and user interaction is not required. The published CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, producing a base score of 7.2. The vendor’s CVSS v4.0 base score is 8.6. The associated weakness is CWE-434, Unrestricted Upload of File with Dangerous Type. NVD’s entry is available at https://nvd.nist.gov/vuln/detail/CVE-2026-14946.
Version enumeration: Inventory FDS102 deployments and confirm the installed software version through the vendor interface, configuration records, or asset-management data. Any FDS102 for FAdC/FAdCi R2 version from 2.8.0 through 2.13.3 requires remediation.frauscher
Scanner signatures: Run authenticated vulnerability scans against FDS102 web interfaces where credentialed testing is authorized. Configure checks for CVE-2026-14946 and the related issues disclosed in VDE-2026-078. Validate scanner findings manually before remediation decisions.
Log indicators: Review web-server and application logs for privileged sessions followed by uploads of .php files, unusual multipart upload requests, requests to /uploads/, or direct requests to newly created .php files. Preserve relevant logs before system changes.
Behavioral anomalies: Look for unexpected administrative accounts, new scheduled tasks or services, unusual outbound connections from FDS102 hosts, abnormal process creation, configuration changes, or diagnostic data inconsistencies following privileged web activity.
Network exploitation indicators: Monitor for access to /uploads/<filename>.php, especially where the requested filename was recently uploaded. Alert on privileged users uploading executable web content and on outbound connections initiated by FDS102 systems to unfamiliar external addresses.
/uploads/.