Remote Code Execution Vulnerability in FUXA Web-based SCADA Software

CVE-2026-47719

What is CVE-2026-47719?

FUXA, a web-based Process Visualization software, is susceptible to a vulnerability where the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers do not properly validate the 'isSocketWriteAuthorized' flag. This oversight permits unauthenticated attackers to exploit these handlers and initiate requests to any HTTP or HTTPS destination. As a result, the attacker may access sensitive information, including internal cloud metadata, administrative services, and industrial data through various protocols such as OPC UA and ODBC. This issue, present in FUXA versions before 1.3.2, poses significant risks to the security of systems utilizing this software. The vulnerability is mitigated in version 1.3.2, which addresses the authorization checks necessary to prevent unauthorized data exposure.

References