CVE-2026-14952
Received Received - Intake

Unauthenticated File Disclosure in FDS Web Server

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: CERT VDE

Description
An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and additional files under /downloads/*, directly over HTTP without a valid session. These files disclose detailed railway signaling and track layout information that should not be available to unauthenticated users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-14952
EUVD
EUVD-2026-63223

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated remote attacker to access sensitive files on the FDS Web server via HTTP without a valid session. Files like /FdsBackup.zip and others under /downloads/ can be retrieved, exposing confidential railway signaling and track layout information.

Detection Guidance

Check for unauthorized access to /FdsBackup.zip or files under /downloads/ via HTTP requests. Use tools like curl to test if these paths are accessible without authentication. Example: curl http://<target>/FdsBackup.zip or curl http://<target>/downloads/*. Monitor web server logs for suspicious requests to these paths.

Impact Analysis

An attacker could exploit this to obtain sensitive infrastructure details, potentially leading to unauthorized access, operational disruptions, or further attacks on railway systems. Confidential data exposure risks include operational security breaches and safety hazards.

Compliance Impact

This vulnerability likely violates data protection and confidentiality requirements under GDPR and HIPAA, as it exposes sensitive infrastructure data without proper access controls. Non-compliance risks include legal penalties, reputational damage, and mandatory breach notifications.

Mitigation Strategies

Restrict access to the /FdsBackup.zip and /downloads/ directories by updating web server configurations. Implement authentication for these paths. Block external HTTP access to sensitive files and review server permissions to ensure no unintended exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14952. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart