EUVD-2026-55220
GHSA-fcm7-v7r7-pvhr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable Socket.IO handler with no auth check (PR:N, AC:L); only sensor data is exposed so I:N and A:N; no scope change as impact is confined to FUXA itself.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
3DescriptionCVE.org
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized() to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.
AnalysisAI
Unauthenticated access to complete historical sensor data is possible in FUXA through version 1.3.3 because the DAQ_QUERY Socket.IO event handler in server/runtime/index.js omits the isSocketAdminAuthorized() check that guards every other sensitive Socket.IO event. Remote attackers can exfiltrate all sensor history without credentials even on deployments where secureEnabled=true is configured, silently undermining an operator's assumption that authentication is fully enforced. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS AV:N/AC:L/PR:N vector confirms this is trivially exploitable by any network-reachable party.
Technical ContextAI
FUXA is an open-source web-based SCADA/HMI/Dashboard platform by frangoteam used in industrial IoT environments for real-time sensor monitoring and process visualization. It uses Socket.IO for bidirectional client-server communication. The application implements a token-based authorization gate via isSocketAdminAuthorized() which is invoked on sensitive events including DEVICE_BROWSE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST when secureEnabled=true. CWE-306 (Missing Authentication for Critical Function) applies here because the DAQ_QUERY handler - responsible for serving historical sensor data from the data acquisition layer - is absent from this authorization pattern in server/runtime/index.js. The affected CPE cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*:* indicates all FUXA releases through 1.3.3 are vulnerable with no version floor.
RemediationAI
No vendor-released patch has been identified at time of analysis. Operators should immediately audit whether FUXA instances are reachable from untrusted networks and, if so, restrict access at the network perimeter by blocking external connections to the FUXA Socket.IO port (default 1881 or the configured application port) using firewall rules or network segmentation. Placing FUXA behind a VPN or authenticated reverse proxy that terminates connections before they reach the Socket.IO layer is the most effective compensating control, though it introduces latency and access management overhead for legitimate users. As an additional measure, operators should monitor Socket.IO traffic for unexpected DAQ_QUERY events originating from unauthenticated or external sources. The upstream fix requires adding an isSocketAdminAuthorized() call to the DAQ_QUERY handler in server/runtime/index.js; track patch availability at https://github.com/frangoteam/FUXA for a remediated release.
FUXA v1.2.7 has hard-coded JWT credentials (EPSS 4.8%) that allow attackers to forge authentication tokens and bypass al
Authentication bypass in FUXA SCADA/HMI system 1.2.8 and prior leading to Remote Code Execution. Unauthenticated attacke
FUXA SCADA has a path traversal vulnerability — ninth critical vulnerability enabling arbitrary file access on SCADA ser
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin. Rated critical severity (CVSS 9.8), this vulnerability is
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download. Rated high severity (CVSS 7.5), this vulnerabilit
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database. Rated high s
FUXA v1.2.7 allows remote code execution through the project import functionality by importing crafted project files con
FUXA SCADA has yet another authorization bypass — now the seventh critical FUXA vulnerability discovered, enabling unaut
FUXA SCADA has an authentication spoofing vulnerability from versions 1.2.8 through 1.2.10 — tenth critical vulnerabilit
FUXA SCADA has insecure default configuration with a known JWT secret — eighth critical vulnerability.
FUXA v1.2.7 has an unrestricted file upload in the /api/upload endpoint that lacks authentication and file type validati
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today