CVE-2026-72586: fallo de gravedad alta en frangoteam FUXA
frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.6%
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Productos afectados
frangoteam · FUXACVEs relacionadas — frangoteam FUXA
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-25895CRITICALFUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APIEPSS 12.8%CVE-2026-25939CRITICALFUXA Unauthenticated Remote Arbitrary Scheduler WriteEPSS 12.5%CVE-2026-47717HIGHFUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device ConfigurationsEPSS 1.4%CVE-2026-25951HIGHFUXA has a Path Traversal Sanitization BypassEPSS 1.3%CVE-2026-25938CRITICALFUXA Unauthenticated Remote Code Execution in Node-RED IntegrationEPSS 1.1%CVE-2026-43947HIGHFUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization BypassEPSS 0.9%