CVE-2026-47720 in FUXA
Summary
by MITRE • 08/18/2026
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
FUXA serves as a web-based Process Visualization software functioning within SCADA, HMI, and dashboard environments to monitor industrial processes. A critical security vulnerability exists within the TDengine DAQ storage connector prior to version 1.3.2, specifically located in the escapeTdString function found in server/runtime/storage/tdengine/index.js. This flaw stems from an incomplete sanitization mechanism where single quotes are properly escaped by doubling them, but backslashes are left unescaped. In SQL injection contexts involving databases that use backslash as an escape character, such as MySQL or TDengine under certain configurations, the failure to handle backslashes correctly allows attackers to manipulate how subsequent characters are interpreted by the database engine.
The technical flaw enables a remote unauthenticated attacker to execute arbitrary SQL commands through crafted inputs submitted via two primary vectors: GET requests to /api/daq and Socket.IO DAQ_QUERY events. By injecting specific sequences of backslashes followed by single quotes, an attacker can bypass the existing quote-escaping logic. The database interprets this sequence as a syntax modification that neutralizes the escaping effect on subsequent characters or alters the query structure entirely. This allows the injection of malicious SQL statements that are executed with the privileges of the application user connecting to TDengine.
The operational impact of this vulnerability is severe, resulting in unrestricted data exposure without requiring authentication credentials. Even when FUXA enforces access controls for its web interface and API endpoints, the underlying database query logic remains vulnerable due to the lack of input validation at the storage layer. An attacker can exploit this flaw to retrieve every row from the fuxa.meters table. This action exposes sensitive historical PLC tag values, device identifiers, and device names. Such data leakage provides adversaries with detailed insights into industrial operations, potentially facilitating further attacks such as process manipulation or social engineering based on known infrastructure details.
This vulnerability aligns with CWE-89 Improper Neutralization of Special Elements used in an SQL Command commonly referred to as SQL Injection. The attack vector corresponds to ATT&CK technique T1059 Command and Scripting Interpreter, specifically through the use of database commands for data exfiltration. To mitigate this risk, organizations must upgrade FUXA to version 1.3.2 or later where the escapeTdString function has been corrected to properly handle backslashes alongside single quotes. Additionally, implementing parameterized queries or prepared statements is recommended as a defense-in-depth strategy to prevent SQL injection regardless of input sanitization logic. Regular security audits and static code analysis should be employed to identify similar patterns in other storage connectors within industrial control systems software.