Fs develops a narrow line of network storage and data appliance products, including the S3150 and S3900 series, that expose application-layer security surfaces. The recurring vulnerability pattern centers on web-interface handling issues including cleartext credential storage, cross-site request forgery, and cross-site scripting, reflecting common input-validation and session-management weaknesses in embedded management interfaces. Current severity, exploitation status, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Fs over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-30350HIGH FS S3900-24T4S devices allow authenticated attackers with guest access to escalate their privileges and reset the admin password. | May 29, 2023 | 8.8 | 40 | NO | YES |
CVE-2025-25613HIGH FS Inc S3150-8T2F 8-Port Gigabit Ethernet L2+ Switch, 8 x Gigabit RJ45, with 2 x 1Gb SFP, Fanless. All versions before 2.2.0D Build 135103 were discovered to transmit cookies for t | Nov 20, 2025 | 7.5 | 26 | NO | NO |
CVE-2020-24033HIGH An issue was discovered in fs.com S3900 24T4S 1.7.0 and earlier. The form does not have an authentication or token authentication mechanism that allows remote attackers to forge re | Oct 22, 2020 | 8.8 | 26 | NO | NO |
CVE-2025-25625MEDIUM A stored cross-site scripting vulnerability exists in FS model S3150-8T2F switches running firmware s3150-8t2f-switch-fsos-220d_118101 and web firmware v2.2.2, which allows an auth | Mar 13, 2025 | 5.4 | 18 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Fs.
Media articles that mention a CVE ID that affects a product developed by Fs — matched by CVE ID, not by vendor name.