Vulnerabilidades do Frangoteam Fuxa

CVE-2026-67442 Baixa · 2.0 CWE-284 18/08/2026

FUXA Business Logic Flaw: Role Deletion Without User Assignment Cleanup

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions through server/runtime/users/usrstorage.js but does not remove the deleted role identifier from each user's info.roles array or the runtime usersMap cache. If a permission configuration still references that identifier, an affected user can retain authorization rights that an administrator intended to revoke, causing residual privilege, inconsistent access-control state, and misleading audit results. This issue is fixed in version 1.3.3.

CVE-2026-67443 Crítica · 9.2 CWE-862 18/08/2026

FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure, a remote unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and use it to access the RED.httpAdmin editor and flow deployment API. Because the Node-RED configuration has no second adminAuth gate, the attacker can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript, gaining control of FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and potentially operating-system commands when nodeRedUnsafeModules is enabled. This issue is fixed in version 1.3.3.

CVE-2026-67440 Média · 6.9 CWE-862 18/08/2026

FUXA: Unauthenticated Socket.IO read events

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.

CVE-2026-65985 Média · 6.0 CWE-918 18/08/2026

FUXA: SSRF hardening for `device-webapi-request`

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or HTTPS request and return the response body to the requesting socket. The attacker can use the server as a read SSRF oracle against reachable internal services or cloud metadata endpoints, with impact depending on the FUXA host's deployment network. This issue is fixed in version 1.3.3.

CVE-2026-65984 Alta · 7.5 CWE-613 18/08/2026

FUXA: JWT lifecycle flaws allow deleted or demoted users to retain privileged sessions

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js re-signs inbound JWT claims without validating the current database record. An attacker who possesses a previously issued privileged refresh cookie or access token can continue minting privileged JWTs after account deletion, disablement, role removal, or demotion. Continued refresh-cookie rotation can extend the stale session and preserve unauthorized access to user management, project manipulation, runtime configuration, scripts, and backdoor-account creation. This issue is fixed in version 1.3.3.

CVE-2026-47721 Média · 6.3 CWE-862 18/08/2026

FUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin operator can create or alter deviceActions that invoke onSetValue or onRunScript, or delete schedules, gaining access to device-value changes and server-side project script execution normally reserved for administrators. Scheduled and repeating actions can continue changing PLC setpoints, safety interlocks, device state, or project data after the operator's session ends. This issue is fixed in version 1.3.2.

CVE-2026-47720 Média · 5.3 CWE-89 18/08/2026

FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2.

CVE-2026-47719 Alta · 8.2 CWE-918 18/08/2026

FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO event. This read SSRF oracle can expose cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data reachable from the FUXA host, including when secureEnabled is true. This issue is fixed in version 1.3.2.

CVE-2026-47718 Média · 5.5 CWE-287 12/08/2026

FUXA provides guest and invalid-token access to protected read APIs in secure mode

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.

CVE-2026-47717 Alta · 7.5 CWE-201 12/08/2026

FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

CVE-2026-72586 Alta · 7.5 CWE-306 10/08/2026

frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.

CVE-2026-43947 Alta · 8.9 CWE-863 21/07/2026

FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.

CVE-2026-43946 Alta · 7.7 CWE-863 21/07/2026

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.

CVE-2026-43945 Alta · 8.9 CWE-94 21/07/2026

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

CVE-2025-69985 Crítica · 9.8 Exploit público CWE-288 24/02/2026

Authentication Bypass Using an Alternate Path or Channel em Frangoteam Fuxa

FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer header to match the server's host. Successful exploitation allows the attacker to access the protected /api/runscript endpoint and execute arbitrary Node.js code on the server.

CVE-2026-25951 Alta · 7.2 CWE-22 09/02/2026

FUXA has a Path Traversal Sanitization Bypass

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ....//), an attacker can write arbitrary files to the server filesystem, including sensitive directories like runtime/scripts. This leads to Remote Code Execution (RCE) when the server reloads the malicious scripts. This vulnerability is fixed in 1.2.11.

CVE-2026-25939 Crítica · 9.1 CWE-862 09/02/2026

FUXA Unauthenticated Remote Arbitrary Scheduler Write

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.2.11.

CVE-2026-25938 Crítica · 9.8 CWE-290 09/02/2026

FUXA Unauthenticated Remote Code Execution in Node-RED Integration

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.

CVE-2026-25895 Crítica · 9.8 Exploit público CWE-22 09/02/2026

FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

CVE-2026-25894 Crítica · 9.8 CWE-321 09/02/2026

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.

CVE-2026-25893 Crítica · 9.8 CWE-285 09/02/2026

FUXA Unauthenticated Remote Code Execution via Admin JWT Minting

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

CVE-2026-25752 Crítica · 9.1 CWE-862 06/02/2026

FUXA: Falta de Autorização na Modificação de Tags de Dispositivos via WebSocket

O FUXA é um software web de Visualização de Processos (SCADA/HMI/Dashboard). Uma vulnerabilidade de bypass de autorização no FUXA permite que um atacante remoto não autenticado modifique tags de dispositivos via WebSockets. A exploração permite que um atacante remoto não autenticado ignore os controles de acesso baseados em funções, sobrescreva tags de dispositivos arbitrárias ou desative drivers de comunicação, expondo ambientes ICS/SCADA conectados a ações subsequentes. Isso pode permitir que um atacante manipule processos físicos e dispositivos desconectados a partir da HMI. Afeta o FUXA até a versão 1.2.9. Este problema foi corrigido na versão 1.2.10 do FUXA.

CVE-2026-25751 Alta · 7.5 CWE-306 06/02/2026

FUXA Unauthenticated Exposure of Plaintext Database Credentials

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

CVE-2025-69983 Crítica · 9.8 CWE-94 03/02/2026

FUXA: Execução Remota de Código via Importação de Projeto (CWE-94)

FUXA v1.2.7 permite Execução Remota de Código (RCE) por meio da funcionalidade de importação de projetos. A aplicação não sanitiza nem isola adequadamente scripts fornecidos pelo usuário dentro de arquivos de projeto importados. Um atacante pode enviar um projeto malicioso contendo comandos de sistema, levando ao comprometimento total do sistema.

CVE-2025-69981 Crítica · 9.8 CWE-434 03/02/2026

FUXA: upload irrestrito de arquivos em API sem autenticação

O FUXA versão 1.2.7 contém uma vulnerabilidade de upload irrestrito de arquivos no endpoint de API /api/upload. O endpoint não possui mecanismos de autenticação, permitindo que atacantes remotos não autenticados façam upload de arquivos arbitrários. Isso pode ser explorado para sobrescrever arquivos críticos do sistema (como o banco de dados SQLite de usuários) e obter acesso administrativo, ou para enviar scripts maliciosos e executar código arbitrário.