Read the docs
TI-2025-03193 Aliases CVE-2025-3626GHSA-43fm-wrjr-xr6x

OS Command Injection via Config Upload in WebUI

Priority MEDIUM 43CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A remote attacker with administrator account can gain full control of the device due to improper neutralization of special elements used in an OS Command ('OS Command Injection') while uploading a config file via webUI.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00912 60th percentileScored 2026-11-07
Fix Fixed FDS102 (Frauscher): v2.13.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
FrauscherFDS102v2.8.0 to before v2.13.3v2.13.3Patch availableCNA
  • FDS102 VendorFrauscher Affected v2.8.0 to before v2.13.3 Fixed in v2.13.3 Patch available CNA

Remediation

  • Fix · CNA FDS102 (Frauscher) Fixed in v2.13.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Frauscher FDS102 v2.13.3

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-03264 OS Command Injection via USB Config LoadPriority LOW 31
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-3626
  2. 2026-10-03 Alias added: GHSA-43fm-wrjr-xr6x

References

Other 1

  • TI-2023-03967 Frauscher FDS101 for FAdC/FAdCi remote code execution vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-03290 Frauscher Sensortechnik Diagnostic System FDS102 for FAdC R2 and FAdCi R2 configuration upload vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2023-03841 Frauscher FDS101 for FAdC/FAdCi path traversal vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-02699 Frauscher Sensortechnik Diagnostic System FDS001 for FAdC/FAdCi Path Traversal vulnerability CVSS 3.1HIGH 7.5
  • TI-2023-05065 Frauscher: FDS102 for FAdC/FAdCi remote code execution vulnerability CVSS 3.1HIGH 8.8
  • TI-2025-03264 OS Command Injection via USB Config Load CVSS 3.1MEDIUM 6.8
See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences