CVE-2026-72586: CWE-306: Missing Authentication for Critical Function in frangoteam FUXA
CVE-2026-72586 is a high-severity vulnerability in frangoteam FUXA up to version 1.3.3 where the DAQ_QUERY Socket.IO event handler lacks authentication checks. This allows unauthenticated remote attackers to query all historical sensor data. Other sensitive Socket.IO events enforce token-based authorization when secureEnabled=true, but DAQ_QUERY does not, leading to unauthorized data access.
AI Analysis
Technical Summary
The vulnerability arises from missing authentication in the DAQ_QUERY event handler within frangoteam FUXA through version 1.3.3. While other sensitive Socket.IO events require a valid connection token verified by isSocketAdminAuthorized when secureEnabled=true, the DAQ_QUERY handler in server/runtime/index.js does not perform this check. This flaw permits unauthenticated remote attackers to retrieve all historical sensor data without authorization. No patch or official remediation has been documented as of the publication date.
Potential Impact
An unauthenticated remote attacker can access all historical sensor data via the DAQ_QUERY Socket.IO event, potentially exposing sensitive information. The vulnerability does not impact integrity or availability but results in a confidentiality breach. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Socket.IO interface to trusted users only, or disable the DAQ_QUERY event if possible. Monitor for updates from frangoteam regarding an official fix or mitigation.
CVE-2026-72586: CWE-306: Missing Authentication for Critical Function in frangoteam FUXA
Description
CVE-2026-72586 is a high-severity vulnerability in frangoteam FUXA up to version 1.3.3 where the DAQ_QUERY Socket.IO event handler lacks authentication checks. This allows unauthenticated remote attackers to query all historical sensor data. Other sensitive Socket.IO events enforce token-based authorization when secureEnabled=true, but DAQ_QUERY does not, leading to unauthorized data access.
CVSS v3.1
Score 7.5high
Affected software
frangoteam
FUXA
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises from missing authentication in the DAQ_QUERY event handler within frangoteam FUXA through version 1.3.3. While other sensitive Socket.IO events require a valid connection token verified by isSocketAdminAuthorized when secureEnabled=true, the DAQ_QUERY handler in server/runtime/index.js does not perform this check. This flaw permits unauthenticated remote attackers to retrieve all historical sensor data without authorization. No patch or official remediation has been documented as of the publication date.
Potential Impact
An unauthenticated remote attacker can access all historical sensor data via the DAQ_QUERY Socket.IO event, potentially exposing sensitive information. The vulnerability does not impact integrity or availability but results in a confidentiality breach. The CVSS 3.1 base score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict network access to the Socket.IO interface to trusted users only, or disable the DAQ_QUERY event if possible. Monitor for updates from frangoteam regarding an official fix or mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- TuranSec
- Date Reserved
- 2026-08-10T10:32:53.854Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a79ae70bf8831d5398afd47
Added to database: 08/10/2026, 10:56:48 UTC
Last enriched: 08/17/2026, 15:58:13 UTC
Last updated: 09/24/2026, 13:47:48 UTC
Views: 54
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.