The vulnerability arises from insufficient session expiration logic that allows an attacker who has obtained a valid session identifier to continue using the session after it should have expired. This flaw exposes a remote, unauthenticated attacker to extended access to the FDS web interface, potentially enabling unauthorized actions that would normally require re‑authentication. By hijacking or reusing a session that should have been invalidated, the attacker can maintain control over the system for an arbitrary period.

The affected device is Frauscher Sensortechnik’s FDS 102 line. No specific firmware version ranges are documented in the advisory, so all installations of the FDS 102 product should be considered potentially vulnerable until a patch is applied or additional version information is published.

The CVSS score of 9.2 highlights the high severity of the flaw, while the EPSS score of less than 1% indicates that exploitation is currently rare but the risk remains substantial. Although the vulnerability is not listed in the CISA KEV catalog, the flaw permits remote, unauthenticated session hijacking that could be leveraged to perform privileged actions via the web interface. The attack vector is remote; a threat actor only needs a valid session ID, which could be stolen, leaked, or shared, and may bypass authentication once the session is hijacked.