Executive brief
FUXA, an open-source industrial monitoring and control (HMI/SCADA) platform, contains a security flaw that allows unauthorized users to download entire project configurations. This includes sensitive information such as server-side automation scripts, device connection details, and alarm settings. An attacker could use this data to understand internal operations or plan more disruptive attacks against industrial infrastructure.
Technical details
The `/api/project` endpoint in FUXA v1.3.0 fails to enforce proper authentication due to a flaw in the `verifyToken` middleware. When no authentication token is provided, the system automatically generates and signs a valid 'guest' JWT, which passes the security check. While some UI elements are filtered, the backend response still includes sensitive metadata such as full server-side script source code, device communication endpoints, HMI SVG layouts, and alarm thresholds. This is classified as an insertion of sensitive information into sent data (CWE-201). The vulnerability is addressed in version 1.3.1.
Affected products
- frangoteam FUXA 1.3.0
Timeline
- 2026-05-26: disclosed
- 2026-05-27: advisory
- 2026-05-27: patched: Fixed in version 1.3.1
References
- https://api.github.com/users/AbdrrahimDahmani
- https://github.com/AbdrrahimDahmani
- https://api.github.com/users/AbdrrahimDahmani/gists%7B/gist_id%7D
- https://api.github.com/users/AbdrrahimDahmani/repos
- https://avatars.githubusercontent.com/u/80603216?v=4
- https://api.github.com/users/AbdrrahimDahmani/events%7B/privacy%7D