CVE-2026-47720

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.2

Description The TDengine DAQ storage connector contains a flaw in the escapeTdString() function located in server/runtime/storage/tdengine/index.js. While the function doubles single quotes, it fails to escape backslashes. A remote unauthenticated attacker can exploit this by submitting a crafted sids variable through the 'GET /api/daq' endpoint or the Socket.IO 'DAQ QUERY' event. This allows the attacker to bypass escaping logic and inject SQL syntax that TDengine interprets, potentially enabling the retrieval of all rows from fuxa.meters. This exposure includes historical PLC tag values, device identifiers, and device names, regardless of whether authentication is enabled.

Recommendations Update to version 1.3.2.