FUXA Authorization Bypass and Info Disclosure

Unauthenticated HTTP requests to the /nodered endpoint of FUXA 1.3.2-2809 can bypass authorization and reach a code-execution path, giving a network attacker high impact to confidentiality, integrity, and availability (CVSS 9.8). The vulnerable component is FUXA's Node-RED integration endpoint; the supplied intelligence does not identify a CISA KEV designation or public exploit code at time of analysis, while the vuln.today priority decision is act_now. Internet-exposed or broadly reachable FUXA deployments that expose /nodered should therefore be treated as urgent exposure, whereas strictly segmented instances are less directly reachable.

Authorization bypass in FUXA 1.3.2-2809 lets an unauthenticated remote attacker invoke privileged operations through the /api/runscript endpoint. The issue is rated CVSS 5.6 medium with low confidentiality, integrity and availability impact; the independent assessment treats it as AV:N/AC:L/PR:N/UI:N, although the supplied vector records AC:H and the sources do not describe the specific request malformation. No public exploit identified at time of analysis and no CISA KEV confirmation is present in the provided data, with practical risk gated mainly by whether the FUXA HTTP interface is reachable from an attacker's network.

FUXA 1.3.2-2809 exposes an unauthenticated information disclosure through its /nodered/fuxa/scripts endpoint, allowing remote attackers to read limited data from the SCADA/HMI web application. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), so no credentials or user interaction are required and only confidentiality is affected; the exact data leaked is not specified in the available sources. No public exploit code or CISA KEV entry was identified at time of analysis, and the practical risk is highest where the FUXA instance is reachable from untrusted networks.