Security readout for executives and security teams
Plain-English summary
FDS 102 version 2.1.0 may continue accepting a valid web session identifier after the session should expire. Someone who obtains a stolen, leaked, shared, or unattended identifier could retain unauthorized access, potentially affecting sensitive information, system settings, and availability.
Executive priority
Treat affected, reachable systems as an urgent remediation priority because retained sessions could permit high-impact unauthorized access. Immediately reduce management-interface exposure, determine whether session identifiers may have been exposed, and obtain current vendor remediation guidance. Evidence does not currently establish active exploitation.
Technical view
CVE-2026-14950 is a CWE-613 insufficient session expiration flaw in the FDS web interface. The supplied record identifies FDS 102 version 2.1.0 as affected and assigns CVSS 3.1 score 9.8. Exploitation is network-based, requires low complexity, and requires possession of an already-valid session identifier.
Likely exposure
Exposure is greatest where the FDS web interface is reachable from untrusted or broadly accessible networks and session identifiers may be captured, leaked, shared, or left unattended. The supplied evidence identifies only version 2.1.0 as affected; other versions should not be presumed vulnerable.
Exploitation context
The attacker does not need account credentials but must possess a valid session identifier. The supplied sources do not establish active exploitation, public exploit availability, or CISA KEV inclusion. Continued access may be difficult to distinguish from legitimate session activity.
Researcher notes
The record describes flawed expiration logic but provides no detailed root cause, patch version, workaround, or exploitation telemetry. Scope claims should remain limited to FDS 102 version 2.1.0. Testing should focus on server-side invalidation across timeout and logout boundaries without exposing session identifiers or disrupting operational systems.
Mitigation direction
- Inventory FDS 102 installations and identify systems running version 2.1.0.
- Restrict the FDS web interface to trusted management networks and authorized administrators.
- Review CERT@VDE and Frauscher guidance for an approved update or remediation.
- Reduce opportunities for session leakage through controlled administrative access and secure endpoint practices.
- Monitor for sessions continuing after logout, timeout, credential changes, or administrative termination.
Validation and detection
- Confirm each device's product identity and exact installed version.
- Document whether the web interface is reachable from untrusted or user-accessible networks.
- In an authorized test environment, verify sessions become unusable after configured expiration and logout.
- Review access logs for unexpectedly long sessions or activity after expected termination.
- After remediation, repeat expiration testing and confirm network restrictions remain effective.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-613: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-14950 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9CERTVDECVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——CERTVDEVulnerability scoring details
Base CVSS 4.0 score
9.2CriticalVector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://www.certvde.com/en/advisories/VDE-2026-078/CVE reference, CERTVDE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
DEPRECATED: Insufficient Session Expiration
DEPRECATED: Insufficient Session Expiration represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.