A cross‑site request forgery flaw exists in the FDS 102 web interface because CSRF protection headers are missing. A low privileged attacker can host a malicious page that, when visited by an authenticated user, causes the browser to send authenticated requests to the FDS 102 web interface. The attacker can therefore trigger any action that the authenticated user is allowed to perform, such as changing configuration settings, initiating measurements, or other device‑specific operations. The flaw is a classic example of improper request validation, classified as CWE‑352.

Frauscher Sensortechnik FDS 102 devices are affected. No specific firmware or device revisions are listed as vulnerable, so all currently deployed FDS 102 hardware should be considered at risk until a patch is applied.

The vulnerability scores a CVSS score of 8.6, indicating high severity. The EPSS score is reported as less than 1 %, implying a low probability of exploitation at this time. It is not listed in CISA’s KEV catalog, but its high impact means that once discovered and targeted, it could be leveraged for significant operational disruption. Exploitation requires an attacker to trick an authenticated user into loading a malicious web page, so the attack vector is external via the web interface. The presence of the flaw allows the attacker to act on behalf of the user without needing elevated privileges on the device itself.