Read the docs
TI-2026-35220 Aliases CVE-2026-47719GHSA-w86f-rf9w-h3x6

FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

Priority HIGH 75CWE-918Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO event. This read SSRF oracle can expose cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data reachable from the FUXA host, including when secureEnabled is true. This issue is fixed in version 1.3.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00592 48th percentileScored 2026-11-07
Fix Fixed FUXA (frangoteam): 1.3.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
frangoteamFUXAbefore 1.3.21.3.2Patch availableCNA
—fuxa-server (npm)up to 1.1.14-1243—No fix listedGHSA-w86f-rf9w-h3x6
  • FUXA Vendorfrangoteam Affected before 1.3.2 Fixed in 1.3.2 Patch available CNA
  • fuxa-server (npm) Vendor— Affected up to 1.1.14-1243 Fixed in — No fix listed GHSA-w86f-rf9w-h3x6

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*:*——frangoteam
  • cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*:* Versions — — ·frangoteam

Remediation

  • Fix · CNA FUXA (frangoteam) Fixed in 1.3.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47719
  2. 2026-10-03 Alias added: GHSA-w86f-rf9w-h3x6

References

Other 5

  • TI-2025-42978 FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote… CVSS 3.1CRITICAL 9.8
  • TI-2023-16709 A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA… CVSS 3.1CRITICAL 9.8
  • TI-2023-15187 FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin. CVSS 3.1CRITICAL 9.8
  • TI-2026-32004 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass CVSS 4.0HIGH 8.9
  • TI-2026-32003 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue CVSS 4.0HIGH 7.7
  • TI-2026-35218 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations CVSS 3.1HIGH 7.5
See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences