CVE-2026-47719

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.2

Description FUXA is a web-based Process Visualization software. A remote unauthenticated attacker can exploit a Server-Side Request Forgery (SSRF) issue where the server acts as an oracle to read data from internal or external destinations. This occurs because the DEVICE WEBAPI REQUEST and DEVICE PROPERTY Socket.IO handlers in server/runtime/index.js fail to perform the isSocketWriteAuthorized() authorization check.

An attacker can control the property.address variable to force the server to make axios.get() requests to arbitrary HTTP or HTTPS destinations, or connect to reachable OPC UA and ODBC services. The results are then broadcast back to the attacker via Socket.IO events. This can lead to the exposure of cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data. The issue persists even when secureEnabled is set to true because guest tokens are automatically issued to connecting clients.

Recommendations Update FUXA to version 1.3.2. As a temporary mitigation, restrict network access to the FUXA host to prevent it from reaching sensitive internal services, cloud metadata endpoints, or unauthorized ODBC and OPC UA servers.