Executive brief
FUXA is an industrial control system (ICS/SCADA) visualization and monitoring platform. An unauthenticated attacker can remotely modify device tags and disable communication drivers via WebSocket connections, even when security settings are enabled. This allows attackers to manipulate physical processes and disconnect industrial devices, creating a direct threat to operational safety and equipment integrity.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the WebSocket communication layer of FUXA that fails to enforce authentication and role-based access controls when processing device tag modification requests. An unauthenticated, network-reachable attacker can craft WebSocket messages to overwrite arbitrary device tags or disable communication drivers without requiring credentials or user interaction. The vulnerability affects all versions through 1.2.9, including deployments with runtime.settings.secureEnabled set to true. It has been patched in FUXA version 1.2.10.
Affected products
- FUXA FUXA <=1.2.9
Timeline
- 2026-02-05: disclosed
- 2026-02-05: patched: Fixed in version 1.2.10