Executive brief
FUXA is a web-based SCADA system used to monitor and control industrial equipment like PLCs. A security flaw in the scheduling component allows users with low-level 'operator' access to perform administrative actions, such as changing industrial device settings or running server scripts. This could allow an unauthorized user to disrupt industrial processes, bypass safety interlocks, or gain persistent control over the automation environment.
Technical details
A missing authorization check (CWE-862) in the FUXA Scheduler API allows authenticated users with non-administrative roles to create or modify scheduled tasks. By submitting crafted requests to the POST or DELETE /api/scheduler endpoints, an attacker can schedule privileged operations such as 'setTagValue' (writing to PLCs) or 'runScript' (server-side automation scripts). Because these actions are executed by the system scheduler, they can provide persistent, recurring execution of administrative commands even if the attacker's session ends or if an administrator attempts to manually revert the changes. The vulnerability is addressed in version 1.3.2 by implementing proper JWT-based administrative permission checks.
Affected products
- frangoteam FUXA <= 1.1.14-1243
Timeline
- 2026-05-29: disclosed: Advisory published by vendor
- 2026-06-08: advisory: GitHub Advisory published
- 2026-06-08: patched: Fix confirmed in version 1.3.2