Executive brief
Frangoteam FUXA is a web-based platform used for industrial automation and monitoring (SCADA/HMI). A security flaw in its web interface allows unauthorized individuals to bypass login requirements and access sensitive system information, such as user accounts and role assignments. This could allow an attacker to map out the system's security structure without needing any credentials.
Technical details
An authentication bypass vulnerability exists in the REST API of Frangoteam FUXA SCADA/HMI versions 1.3.1 and earlier. The API router fails to normalize dot-segment sequences (such as '/./' or '/../') before the request reaches the authentication middleware. By crafting requests with these sequences (e.g., /api/./users), an unauthenticated remote attacker can bypass credential checks. Successful exploitation allows for the enumeration of all user accounts and role assignments. The issue is addressed in version 1.3.2.
Affected products
- Frangoteam FUXA SCADA/HMI <= 1.3.1
Timeline
- 2026-06-30: advisory: CISA ICSA-26-181-02 published
- 2026-05-19: patched: Version 1.3.2 released with path normalization fix