CVE-2026-67440

UNKNOWN 0.0

FUXA: Unauthenticated Socket.IO read events

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.

CWE	CWE-862
Vendor	frangoteam
Product	fuxa
Published	Aug 18, 2026

Stay Ahead of the Next One

Get instant alerts for frangoteam fuxa

Be the first to know when new unknown vulnerabilities affecting frangoteam fuxa are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

frangoteam / FUXA

< 1.3.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frangoteam/FUXA/security/advisories/GHSA-rh5p-m38p-2w75 github.com: https://github.com/frangoteam/FUXA/pull/2379 github.com: https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed34f427f472fb4450f86e7749b github.com: https://github.com/frangoteam/FUXA/releases/tag/v1.3.3