Executive brief
FUXA is a web-based industrial control dashboard (SCADA/HMI) used to visualize and monitor production systems. An unauthenticated attacker can exploit exposed Socket.IO event handlers to extract sensitive system metadata—including network interfaces, device tags, and discovery information—without proper authorization checks. While normal operational data remains intentionally public, this metadata leakage enables reconnaissance for targeted follow-up attacks on critical infrastructure.
Technical details
The vulnerability is an authentication bypass affecting Socket.IO event handlers (DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST) in FUXA versions 1.3.2 and earlier. When secureEnabled is true, these handlers fail to enforce the isSocketAdminAuthorized check before returning device-discovery, node-attribute, host-network-interface, and device-tag metadata. An unauthenticated or guest user can directly invoke these events over the Socket.IO connection to enumerate system topology and configuration details. The vulnerability was remedied in version 1.3.3 by adding proper authorization enforcement. Attack requires only network reachability to the web-based FUXA interface; no authentication or user interaction is required.
Affected products
- frangoteam FUXA 1.3.2 and earlier
Timeline
- 2026-08-18: disclosed
- 2026-05-25: patched: Fix released in version 1.3.3