EUVD-2026-40409
GHSA-cgxf-x59w-2x25
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable, low-complexity request with no auth or interaction yields high confidentiality disclosure only; no integrity or availability impact and unchanged scope.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
Lifecycle Timeline
1DescriptionCVE.org
FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by prefixing paths with dot-segments such as /api/./users, /api/./roles, and /api/project/../users. These requests bypass authentication checks and return sensitive user and role data without credentials.
AnalysisAI
Authentication bypass in FUXA SCADA/HMI versions 1.3.1 and prior lets remote unauthenticated attackers reach protected REST API endpoints by inserting dot-segment sequences (e.g. /api/./users, /api/project/../users) that the router fails to normalize before applying its authentication middleware. Successful exploitation returns sensitive user and role data without any credentials. No public exploit identified at time of analysis, though the technique is trivially reproducible and the issue is documented in a CISA ICS advisory (ICSA-26-181-02).
Technical ContextAI
FUXA is an open-source, web-based SCADA/HMI platform (frangoteam) used to build operator dashboards and supervisory control interfaces for industrial/OT environments, exposing a Node.js REST API. The root cause maps to CWE-290 (Authentication Bypass by Spoofing): the API router enforces authentication by matching request paths against protected route prefixes, but it does so before canonicalizing the URL path. Because dot-segments ('./' and '../') are not collapsed prior to the auth check, a path like /api/./users does not literally match the guarded /api/users pattern and slips past the middleware, yet the underlying handler still resolves and serves the protected resource. This is a classic path-normalization-versus-authorization ordering bug where two components disagree on what the path 'is'.
RemediationAI
Upgrade to a fixed FUXA release once published; consult the GitHub releases page (https://github.com/frangoteam/FUXA/releases) and the CISA advisory (https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-02) for the exact patched version, as no fixed version number was provided in this input. Patch status: no specific vendor-released fix version identified at time of analysis - verify against the advisory. Until a confirmed patched build is applied, place FUXA behind a reverse proxy or WAF that canonicalizes or rejects URLs containing dot-segments before they reach the application (block or normalize requests matching /api/./, /api/../ and similar), which closes the bypass without altering FUXA itself but adds a proxy dependency and may false-positive on legitimately encoded paths. As a compensating control, restrict network access to the FUXA REST API to a trusted OT management segment or VPN and remove any internet exposure, accepting that this limits remote operator convenience. Following standard ICS guidance, isolate the HMI from business and internet-facing networks.
Same weakness CWE-290 – Authentication Bypass by Spoofing
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today