CVE-2026-65985 in FUXA
Summary
by MITRE • 08/18/2026
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or HTTPS request and return the response body to the requesting socket. The attacker can use the server as a read SSRF oracle against reachable internal services or cloud metadata endpoints, with impact depending on the FUXA host's deployment network. This issue is fixed in version 1.3.3.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/18/2026
The vulnerability identified in FUXA versions prior to 1.3.3 represents a critical Server-Side Request Forgery (SSRF) flaw rooted in insufficient access control within the application’s WebSocket communication layer. FUXA is widely deployed as a web-based Process Visualization, SCADA, HMI, and Dashboard solution, often managing sensitive industrial or enterprise infrastructure data. The core technical defect resides in the device-webapi-request Socket.IO handler located in server/runtime/index.js. This specific endpoint was designed to facilitate legitimate operational requests but failed to enforce strict role-based access controls for all configurable parameters. Specifically, an authenticated user with non-admin runtime privileges is permitted to manipulate the property.address field. By injecting arbitrary URLs into this parameter, the attacker instructs the FUXA server itself to initiate outbound HTTP or HTTPS connections to destinations of their choosing.
The operational impact of this vulnerability is severe due to its function as a read SSRF oracle. When the malicious request is processed by the backend, the server fetches the content from the target URL and returns the response body directly back to the requesting socket connection. This mechanism allows an attacker with low-level access to probe internal network services that are not exposed to the public internet. In typical deployments where FUXA servers reside within a corporate or industrial control system (ICS) network, this capability enables reconnaissance of internal assets such as database servers, management interfaces for other SCADA components, and cloud metadata endpoints like AWS EC2 instance metadata service 169.254.169.254. The ability to read responses from these internal services can lead to the exfiltration of sensitive configuration data, authentication tokens, or proprietary process information, significantly escalating the risk beyond simple unauthorized access.
From a classification perspective, this vulnerability aligns with CWE-918 Server-Side Request Forgery (SSRF), specifically involving server-side request manipulation via user-controlled input that leads to unintended network interactions. Furthermore, within the MITRE ATT&CK framework, this behavior corresponds to T1571 Non-Standard Port and potentially T1046 Network Service Discovery if used for scanning internal networks. The attack vector is classified as Remote with Low Complexity because it requires only valid authentication credentials, which are often easier to obtain or compromise than exploiting unauthenticated flaws in SCADA environments where legacy systems may have weak default passwords.
Mitigation strategies must prioritize immediate patching and network segmentation. Organizations running FUXA versions 1.3.2 and earlier should upgrade immediately to version 1.3.3, which addresses the permission checks within the Socket.IO handler. In scenarios where upgrading is not immediately feasible, administrators should implement strict firewall rules to restrict outbound HTTP and HTTPS traffic from the FUXA server host to only known and necessary external endpoints. Additionally, deploying an internal web application firewall or reverse proxy with SSRF protection can help detect and block requests attempting to access private IP ranges or cloud metadata services. It is also critical to enforce strong authentication policies for all runtime users to minimize the risk of credential compromise leading to this exploitation chain.