CVE-2026-67443 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

EUVD-2026-61212

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

CVE-2026-65985 FUXA: SSRF hardening for `device-webapi-request`

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

CVE-2026-67440 FUXA: Unauthenticated Socket.IO read events

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the DEVICEBROWSE, DEVICENODEATTRIBUTE, HOSTINTERFACES, and DEVICETAGSREQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata...

CVE-2026-67440 FUXA: Unauthenticated Socket.IO read events

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the DEVICEBROWSE, DEVICENODEATTRIBUTE, HOSTINTERFACES, and DEVICETAGSREQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata...

EUVD-2026-61210

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the DEVICEBROWSE, DEVICENODEATTRIBUTE, HOSTINTERFACES, and DEVICETAGSREQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata...

CVE-2026-67440

In FUXA versions 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST Socket.IO handlers in server/runtime/index.js omit isSocketAdminAuthorized checks when secureEnabled is true, allowing unauthenticated or guest users to collect device-discovery,...

CVE-2026-67440 FUXA: Unauthenticated Socket.IO read events

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the DEVICEBROWSE, DEVICENODEATTRIBUTE, HOSTINTERFACES, and DEVICETAGSREQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata...

CVE-2026-47721 FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or...

CVE-2026-47721 FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or...

EUVD-2026-61209

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or...

CVE-2026-47721

FUXA versions prior to 1.3.2 fail to enforce admin permissions on POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js, allowing authenticated non-admin operators to schedule actions invoking onSetValue or onRunScript, enabling PLC setpoint changes and server-side script...

CVE-2026-47719

FUXA SCADA/HMI software (versions before 1.3.2) exposes unauthenticated Socket.IO handlers DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY that accept attacker-controlled URLs and credentials, turning the server into a read-SSRF oracle capable of exfiltrating cloud metadata, internal services, OPC UA d...

CVE-2026-47719 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the DEVICEWEBAPIREQUEST and DEVICEPROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote...

CVE-2026-47719 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the DEVICEWEBAPIREQUEST and DEVICEPROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote...

CVE-2026-47720 FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a...

CVE-2026-47720

FUXA (SCADA/HMI/Dashboard) versions before 1.3.2 contain a SQL injection (CWE-89) in the escapeTdString function at server/runtime/storage/tdengine/index.js:10, which doubles single quotes but fails to escape backslashes. Because TDengine's SQL parser treats \' as a literal quote, a crafted sids ...

EUVD-2026-61207

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a...

PT-2026-77305

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

PT-2026-77304

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js...