FUXA: Unauthenticated Socket.IO read events
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.9epss 0.5%
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
frangoteam · FUXA