FUXA CVE-2026-40063

Exploitation requires network reachability to the FUXA web application and the ability to send an HTTP request to the /nodered/fuxa/scripts endpoint; per the CVSS vector (PR:N/UI:N) no authentication or user interaction is needed against version 1.3.2-2809. The description does not name any non-default feature, configuration setting, or deployment mode as a prerequisite, so default exposure of this endpoint appears sufficient. The main limiting factor is deployment exposure: FUXA is typically an internal SCADA/HMI server, so impact is largest only where the instance is reachable from untrusted networks; the data also caps impact at a limited confidentiality leak (C:L) with no integrity or availability effect, and the exact information disclosed is not specified in the sources.

This is a moderate-severity (CVSS 5.3) information disclosure flaw whose signals are consistent rather than conflicting. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated attack with only limited confidentiality impact (C:L) and no integrity or availability effect - so the ceiling on damage is an information leak, not code execution or takeover. The vuln.today decision label is 'this_month,' which is a routine-patching priority rather than act_now or emergency. There is no CISA KEV listing and no EPSS score supplied, so there is no evidence of active or probable exploitation; the only external signal is the Talos vulnerability report, which confirms the research finding but is not listed here as working exploit code. Net assessment: a genuine but bounded issue - worth patching on a normal cycle, not a drop-everything emergency. The low real-world footprint of FUXA (see prevalence) further reduces aggregate risk, though any single internet-exposed FUXA/SCADA instance should be remediated promptly because the attack needs no authentication.

An unauthenticated attacker who can reach a FUXA instance over the network sends a specially crafted HTTP request to the /nodered/fuxa/scripts endpoint and receives back information that should not be exposed. No public exploit is identified in the provided data, and the exact data disclosed is not detailed in the available sources. Because the request is unauthenticated and network-based with low complexity, exploitation is straightforward wherever the service is reachable.