CVE-2026-47719

creationtimestamp| type| source ---|---|--- 2026-08-19 01:11:47+00:00| seen| https://bsky.app/profile/hugovalters.bsky.social/post/3mtfkf763wn2i 2026-08-19 01:12:11+00:00| seen| https://mastodon.social/users/hugovalters/statuses/117119510573941685...

CVE-2026-47719

FUXA SCADA/HMI software (versions before 1.3.2) exposes unauthenticated Socket.IO handlers DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY that accept attacker-controlled URLs and credentials, turning the server into a read-SSRF oracle capable of exfiltrating cloud metadata, internal services, OPC UA d...

CVE-2026-47719 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the DEVICEWEBAPIREQUEST and DEVICEPROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote...