CVE-2026-43946

FUXA version 1.3.2 and earlier has a vulnerability in the allowDashboard authorization gate that allows a remote unauthenticated attacker to obtain a signed guest token and access the Node-RED editor and flow deployment API. The attacker can deploy malicious nodes or execute scripts, gaining control over project data, configuration, and potentially the operating system.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions but does not remove the deleted role identifier from user's info.roles array or runtime usersMap cache. This can lead to retained authorization rights after admin revocation.

FUXA version 1.3.2 and earlier does not check isSocketAdminAuthorized for certain Socket.IO events (DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, DEVICE_TAGS_REQUEST) when secureEnabled is true. A remote unauthenticated or guest user can collect system-discovery information not required for normal HMI viewing.

FUXA version 1.3.2 and earlier allows an authenticated non-admin user to control property.address in the device-webapi-request handler, causing the FUXA server to issue outbound HTTP/HTTPS requests and return the response to the attacker. This leads to an SSRF vulnerability.

FUXA version 1.3.2 and earlier improperly handled session refresh, allowing an attacker with a previously issued privileged refresh cookie or access token to continue minting privileged JWTs even after account deletion, disablement, role removal, or demotion. This enabled continued unauthorized access to user management, project manipulation, runtime configuration, and backdoor-account creation. The issue is fixed in version 1.3.3.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler do not consistently enforce admin permissions. An authenticated non-admin operator can create or alter deviceActions or delete schedules, gaining access to device-value changes and server-side script execution.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the escapeTdString function does not escape backslashes, allowing a remote unauthenticated attacker to inject SQL via crafted sids tag identifiers. This can expose historical PLC tag values and device names.

FUXA before version 1.3.2 has a vulnerability allowing a remote unauthenticated attacker to perform SSRF (Server-Side Request Forgery) via the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers. By manipulating property.address or endpoint connection data, the attacker can make the server call axios.get against arbitrary HTTP/HTTPS destinations, including internal services, cloud metadata, OPC UA, or ODBC services. The issue is fixed in version 1.3.2.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.