CVE-2026-47719

The record

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO event. This read SSRF oracle can expose cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data reachable from the FUXA host, including when secureEnabled is true. This issue is fixed in version 1.3.2.

Affected packages

Related vulnerabilities

• GHSA-w86f-rf9w-h3x6 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with… Same vulnerability
• CVE-2026-47720 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
• CVE-2026-47721 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
• GHSA-8ghr-w65f-j3qr FUXA's scheduler API missing admin check enables operator-to-admin escalation via… Also affects fuxa-server
• GHSA-h9fj-c2qr-76g2 FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of… Also affects fuxa-server
• GHSA-r9g5-7q8j-958c FUXA provides guest and invalid-token access to protected read APIs in secure mode Also affects fuxa-server
• CVE-2026-47718 FUXA provides guest and invalid-token access to protected read APIs in secure mode Also affects fuxa-server
• GHSA-q3w6-q3hc-c5x6 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device… Also affects fuxa-server