CVE-2026-47718 in FUXA
Summary
by MITRE • 08/13/2026
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
FUXA represents a web-based industrial process visualization platform that serves as a SCADA/HMI/dashboard solution for operational technology environments. The software operates within critical infrastructure ecosystems where unauthorized access can compromise industrial control systems. When the secureEnabled configuration parameter is set to true, the application should enforce authentication and authorization controls to protect sensitive operational data. However, version 1.3.0-2773 contains a security flaw that allows unauthenticated requests to access project data, alarm notifications, and scheduler information through the API endpoints. This vulnerability exists despite the explicit enabling of security measures, creating a scenario where guest users or those with invalid authentication tokens can bypass access controls and retrieve confidential operational information.
The technical implementation flaw stems from improper validation of authentication tokens within the API request handling mechanism. The application fails to adequately verify session state and token validity before granting access to sensitive data endpoints. This misconfiguration allows attackers to make direct API calls without proper authentication credentials, effectively creating a backdoor for unauthorized data exfiltration. The vulnerability impacts all API endpoints related to project configuration, alarm monitoring, and scheduling functionality, which typically contain operational intelligence critical to industrial processes.
The operational impact of this vulnerability extends beyond simple information disclosure, as it enables potential attackers to gain insights into system configurations, operational schedules, and alarm conditions that could be used for more sophisticated attacks. An attacker with access to scheduler data could potentially disrupt operations by understanding maintenance windows or operational timing. The ability to read project data allows for reconnaissance activities that could reveal system architecture, device inventories, and operational parameters that are typically restricted to authorized personnel only. This vulnerability directly violates security principles of least privilege and access control enforcement.
Organizations utilizing FUXA version 1.3.0-2773 should immediately implement mitigation strategies including upgrading to version 1.3.1 where the issue has been resolved. The upgrade addresses the core authentication bypass flaw by implementing proper token validation mechanisms and ensuring that all API endpoints require valid authentication before granting access. Security administrators should also review existing access controls and monitor for any unauthorized activities in the system logs. The vulnerability aligns with CWE-285, which addresses improper authorization in web applications, and maps to ATT&CK technique T1078 for valid accounts and T1566 for credential harvesting through API exploitation. Organizations should consider implementing additional network segmentation controls and monitoring mechanisms to detect unauthorized API access attempts.