CVE-2026-65985
FUXA: SSRF hardening for `device-webapi-request`
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or HTTPS request and return the response body to the requesting socket. The attacker can use the server as a read SSRF oracle against reachable internal services or cloud metadata endpoints, with impact depending on the FUXA host's deployment network. This issue is fixed in version 1.3.3.
| CWE | CWE-918 |
| Vendor | frangoteam |
| Product | fuxa |
| Published | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for frangoteam fuxa
Be the first to know when new unknown vulnerabilities affecting frangoteam fuxa are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
frangoteam / FUXA
< 1.3.3
References
github.com: https://github.com/frangoteam/FUXA/security/advisories/GHSA-wrg6-49wh-46pw github.com: https://github.com/frangoteam/FUXA/pull/2379 github.com: https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed34f427f472fb4450f86e7749b github.com: https://github.com/frangoteam/FUXA/releases/tag/v1.3.3