CVE-2026-14949 Frauscher Sensortechnik CVE debrief

Who should care

Defenders and security teams responsible for Frauscher Sensortechnik's FDS 102 product should assess exposure and prioritize mitigation. This includes reviewing the vulnerability's potential impact on their systems, verifying the presence of affected components, and planning for necessary updates or mitigations.

Why it matters

This high-severity vulnerability in Frauscher Sensortechnik's FDS 102 product allows low-privileged remote attackers to create new accounts with arbitrary role values, including the highest privilege level used by the application. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where privilege escalation is a concern.

• Potential privilege escalation
• Increased risk of unauthorized access
• Possible lateral movement within the network
• Need for verification of user creation functionality

Technical summary

A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.php to create new accounts with arbitrary role values, including the highest privilege level used by the application. This vulnerability is a high-severity issue in Frauscher Sensortechnik's FDS 102 product. The vulnerability allows for potential privilege escalation and increased risk of unauthorized access. Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where privilege escalation is a concern.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability, especially in systems where privilege escalation is a concern.

Recommended defensive actions

• Verify and validate user input to the /api/user/add.php endpoint
• Implement additional authentication and authorization checks for user creation functionality
• Monitor for suspicious activity related to user account creation
• Consider applying patches or updates provided by the vendor
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score and vector. The vulnerability is a high-severity issue in Frauscher Sensortechnik's FDS 102 product that allows low-privileged remote attackers to create new accounts with arbitrary role values. The CVE record was published on 2026-08-20T09:16:47.307Z and has not been modified since then. There are no known affected scope or additional details available beyond the CVE and NVD entries.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.