FUXA, a web-based SCADA/HMI dashboard software, versions 1.3.2 and earlier have a missing authorization check (CWE-862) in the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers within server/runtime/index.js. When secureEnabled is true, these handlers return device-discovery, node-attribute, host-network-interface, and device-tag metadata without verifying if the requester is an authorized socket admin. This allows remote unauthenticated or guest users to invoke these Socket.IO events and collect system-discovery information that is not intended for public access. The vulnerability does not affect normal device status, value, alarm, or dashboard events, which remain public by design. The issue is resolved in FUXA version 1.3.3.

An unauthenticated or guest remote attacker can retrieve sensitive system-discovery metadata including device and network interface information that should be restricted. This exposure could aid attackers in reconnaissance activities against the affected system. However, critical operational data such as device status, values, alarms, and dashboards are not exposed by this vulnerability. The CVSS 4.0 base score is 6.9, indicating a medium severity impact.

Upgrade FUXA to version 1.3.3 or later, where this missing authorization vulnerability has been fixed. No other mitigation is indicated or required as the fix is official and addresses the issue directly.