FUXA EUVD-2026-40409

Exploitation requires only network reachability to the FUXA REST API; the specific trigger is supplying a request path containing unnormalized dot-segments (e.g. /api/./users, /api/./roles, or /api/project/../users) to endpoints otherwise gated by authentication - no credentials, configuration changes, or user interaction are needed (AV:N/AC:L/PR:N/UI:N). The condition is inherent to default behavior on versions 1.3.1 and prior, not a non-default feature. The primary limiting factor is exposure: the attacker must be able to reach the API endpoint, so deployments where the FUXA API is confined to an isolated OT/management network or sits behind a normalizing proxy are not remotely exploitable from untrusted networks. Impact is limited to disclosure of user and role data (no write/integrity or availability effect indicated).

Signals are consistent and point to a genuine priority for exposed instances. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H, score 8.7) describes a network-reachable, low-complexity attack needing no privileges, no authentication, and no user interaction, with high confidentiality impact and no integrity/availability impact - matching the description of unauthenticated data disclosure. No EPSS score, KEV listing, or SSVC decision data was provided, so probabilistic exploitation likelihood and CISA's automatable/exploitation determinations cannot be cited here; the referenced CSAF advisory (ICSA-26-181-02) likely contains SSVC data not surfaced in this input. There is no conflict between the vector and the description. The main real-world risk modifier is exposure: FUXA is an OT/HMI product that should not be internet-facing, so blast radius depends heavily on whether the API is reachable from untrusted networks. Treat as high priority where FUXA is exposed beyond a trusted management segment; lower urgency for properly segmented deployments.

An attacker who can reach the FUXA web API over the network sends a crafted GET request such as /api/./users or /api/project/../users; the dot-segment evades the authentication middleware while the handler still serves the data, returning user accounts and role assignments with no login. The harvested credential and role metadata can then be used to plan deeper compromise of the SCADA/HMI environment. No public proof-of-concept was identified, but the request is simple enough to construct manually from the description.