CVE-2026-65985: CWE-918: Server-Side Request Forgery (SSRF) in frangoteam FUXA
CVE-2026-65985 is a Server-Side Request Forgery (SSRF) vulnerability in frangoteam's FUXA software, versions 1.3.2 and earlier. It allows an authenticated non-admin runtime user to manipulate the device-webapi-request handler to make the server issue arbitrary HTTP or HTTPS requests. The vulnerability is fixed in version 1.3.3.
AI Analysis
Technical Summary
FUXA, a web-based SCADA/HMI/Dashboard software, contains an SSRF vulnerability in the device-webapi-request Socket.IO handler located in server/runtime/index.js. Authenticated non-admin runtime users can control the property.address parameter, causing the server to send outbound HTTP or HTTPS requests and return the response body to the attacker. This enables the attacker to use the FUXA server as a read SSRF oracle against internal network services or cloud metadata endpoints. The vulnerability is resolved in version 1.3.3.
Potential Impact
An authenticated non-admin user can exploit this SSRF vulnerability to read data from internal services or cloud metadata endpoints accessible from the FUXA host. The impact depends on the network environment where FUXA is deployed. This could lead to unauthorized information disclosure from internal resources.
Mitigation Recommendations
Upgrade FUXA to version 1.3.3 or later, where this SSRF vulnerability is fixed. No additional mitigation actions are specified or required beyond applying this official fix.
CVE-2026-65985: CWE-918: Server-Side Request Forgery (SSRF) in frangoteam FUXA
Description
CVE-2026-65985 is a Server-Side Request Forgery (SSRF) vulnerability in frangoteam's FUXA software, versions 1.3.2 and earlier. It allows an authenticated non-admin runtime user to manipulate the device-webapi-request handler to make the server issue arbitrary HTTP or HTTPS requests. The vulnerability is fixed in version 1.3.3.
CVSS v4.0
Score 6.0medium
Affected software
frangoteam
FUXA
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
FUXA, a web-based SCADA/HMI/Dashboard software, contains an SSRF vulnerability in the device-webapi-request Socket.IO handler located in server/runtime/index.js. Authenticated non-admin runtime users can control the property.address parameter, causing the server to send outbound HTTP or HTTPS requests and return the response body to the attacker. This enables the attacker to use the FUXA server as a read SSRF oracle against internal network services or cloud metadata endpoints. The vulnerability is resolved in version 1.3.3.
Potential Impact
An authenticated non-admin user can exploit this SSRF vulnerability to read data from internal services or cloud metadata endpoints accessible from the FUXA host. The impact depends on the network environment where FUXA is deployed. This could lead to unauthorized information disclosure from internal resources.
Mitigation Recommendations
Upgrade FUXA to version 1.3.3 or later, where this SSRF vulnerability is fixed. No additional mitigation actions are specified or required beyond applying this official fix.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-07-23T18:54:15.832Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a84be80c6e8be0332b43d23
Added to database: 08/18/2026, 20:20:16 UTC
Last enriched: 09/11/2026, 20:49:15 UTC
Last updated: 10/02/2026, 14:46:09 UTC
Views: 70
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.