frangoteam vulnerabilities and threats

CVE-2026-42949 is an authorization bypass vulnerability in the /api/runscript endpoint of Frangoteam's FUXA product version 1.3.2-2809. This flaw allows an unauthenticated attacker to execute privileged operations by sending a specially crafted HTTP request. The vulnerability has a medium severity rating with a CVSS score of 5.6.

CVE-2026-40063 is an information disclosure vulnerability in the /nodered/fuxa/scripts functionality of Frangoteam's FUXA product version 1.3.2-2809. An unauthenticated attacker can send a specially crafted HTTP request to trigger this flaw and leak sensitive information.

CVE-2026-42922 is a critical authorization bypass vulnerability in the /nodered functionality of Frangoteam FUXA version 1.3.2-2809. This flaw allows an unauthenticated attacker to send a specially crafted HTTP request that can lead to arbitrary code execution on the affected system.

CVE-2026-67442 is an improper access control vulnerability in frangoteam's FUXA web-based Process Visualization software. Versions prior to 1.3.3 have an issue where deleting a role does not fully remove the role identifier from users' role arrays or runtime caches. This can cause users to retain permissions that administrators intended to revoke, leading to residual privileges and inconsistent access control states. The issue is fixed in version 1.3.3.

FUXA versions 1.3.2 and earlier suffer from insufficient session expiration, allowing attackers with previously issued privileged refresh cookies or access tokens to continue minting privileged JWTs even after account deletion or role changes. This enables unauthorized persistent access to sensitive functions such as user management and backdoor account creation. The vulnerability is fixed in version 1.3.3.

FUXA versions 1.3.2 and earlier contain a missing authorization vulnerability in the Node-RED integration. An unauthenticated remote attacker can obtain a signed guest token and access the Node-RED HTTP admin editor and flow deployment API without proper identity verification. This allows the attacker to deploy function nodes or invoke scripts, potentially gaining control over project data, configuration, scripts, and runtime helpers, including operating system commands if unsafe modules are enabled. The issue is fixed in version 1.3.3.

CVE-2026-65985 is a Server-Side Request Forgery (SSRF) vulnerability in frangoteam's FUXA software, versions 1.3.2 and earlier. It allows an authenticated non-admin runtime user to manipulate the device-webapi-request handler to make the server issue arbitrary HTTP or HTTPS requests. The vulnerability is fixed in version 1.3.3.

FUXA versions 1.3.2 and earlier have a missing authorization vulnerability in certain Socket.IO event handlers that allow unauthenticated or guest users to access device and network metadata. This issue does not expose normal device status or alarm data but reveals system-discovery information beyond what is intended for public viewing. The vulnerability is fixed in version 1.3.3.

FUXA versions prior to 1.3.2 have a missing authorization vulnerability in the scheduler API endpoints. Authenticated non-admin users can create, modify, or delete scheduled device actions that normally require admin permissions. This allows unauthorized changes to device values and execution of server-side scripts, potentially affecting PLC setpoints, safety interlocks, and project data even after the user's session ends. The issue is fixed in version 1.3.2.

CVE-2026-47719 is a Server-Side Request Forgery (SSRF) vulnerability in frangoteam's FUXA software, a web-based SCADA/HMI/Dashboard tool. Versions prior to 1.3.2 allow unauthenticated remote attackers to make the server perform HTTP(S) requests to arbitrary destinations by exploiting insufficient authorization checks in Socket.IO handlers. This can expose sensitive internal resources such as cloud metadata, administrative services, industrial endpoints, and ODBC data accessible from the FUXA host. The vulnerability is fixed in version 1.3.2.

CVE-2026-47720 is a SQL injection vulnerability in FUXA, a web-based SCADA/HMI/Dashboard software. Versions prior to 1.3.2 have an issue in the TDengine DAQ storage connector where backslashes are not properly escaped in SQL queries. This allows a remote unauthenticated attacker to inject SQL via crafted requests, potentially exposing historical PLC tag values, device identifiers, and device names. The vulnerability is fixed in version 1.3.2.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

CVE-2026-72586 is a high-severity vulnerability in frangoteam FUXA up to version 1.3.3 where the DAQ_QUERY Socket.IO event handler lacks authentication checks. This allows unauthenticated remote attackers to query all historical sensor data. Other sensitive Socket.IO events enforce token-based authorization when secureEnabled=true, but DAQ_QUERY does not, leading to unauthorized data access.

FUXA version 1.3.0 contains an unauthenticated remote code execution vulnerability in the POST /api/runscript endpoint when secureEnabled is true. An attacker can exploit the test mode feature to execute arbitrary code by supplying a valid script ID and name. This occurs because the endpoint executes attacker-supplied code instead of the stored script's code when test: true is set. The vulnerability is fixed in version 1.3.1.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.

FUXA versions 1.2.11 through 1.3.0 contain a critical vulnerability allowing unauthenticated remote attackers to execute arbitrary code as root. This vulnerability persists even when the software is configured with its most secure settings enabled. The issue is resolved in version 1.3.1.

FUXA versions 1.3.1 and prior contain an authentication bypass vulnerability via dot-segment path normalization in the REST API. The API router fails to normalize dot-segment sequences before applying authentication middleware, allowing unauthenticated requests to access protected endpoints by prefixing paths with dot-segments such as /api/./users, /api/./roles, and /api/project/../users. These requests bypass authentication checks and return sensitive user and role data without credentials.

FUXA 1.2.9 - RCE

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.