CVE-2026-72586 in FUXA
Summary
by MITRE • 08/10/2026
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized() to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
The vulnerability under discussion affects frangoteam/FUXA version 1.3.3 and earlier, representing a critical authentication bypass flaw that exposes sensitive industrial data to unauthenticated remote attackers. This issue stems from inconsistent security implementation within the Socket.IO event handling mechanism of the application's runtime component. The core problem manifests when the secureEnabled configuration parameter is set to true, which should theoretically enforce authentication requirements across all sensitive communication channels. However, the DAQ_QUERY event handler presents a dangerous exception that completely omits the required authorization verification step.
The technical flaw resides in the server/runtime/index.js file where the DAQ_QUERY Socket.IO event handler fails to invoke the isSocketAdminAuthorized() function that serves as the primary authentication gatekeeper for other sensitive operations. This inconsistency creates an exploitable gap in the application's security architecture, allowing malicious actors to access historical sensor data without proper credentials. The vulnerability specifically impacts the DAQ_QUERY event which is designed to retrieve data acquisition queries, but due to the missing authorization check, any remote attacker can query this endpoint regardless of their authentication status.
From an operational perspective, this vulnerability poses significant risks to industrial control systems and supervisory control and data acquisition environments where FUXA is deployed. The exposure of historical sensor data represents a substantial information disclosure threat that could provide attackers with valuable insights into system operations, environmental conditions, and potentially sensitive operational parameters. This data could be leveraged for further attacks including reconnaissance, system mapping, or targeting of other connected systems within the industrial network infrastructure.
The security implications extend beyond simple data exposure, as this vulnerability aligns with CWE-285 which addresses insufficient authorization issues in software applications. Attackers could potentially combine this authentication bypass with other techniques to escalate privileges or execute additional malicious activities through the compromised communication channel. The ATT&CK framework would categorize this as a privilege escalation technique leveraging insecure communication protocols, specifically targeting the command and control phases where adversaries establish persistent access to industrial environments.
Organizations should immediately implement mitigations including disabling the DAQ_QUERY endpoint when not required, enforcing strict network segmentation around FUXA installations, and implementing additional authentication layers at the network perimeter. The most effective immediate solution involves patching the application to ensure that all Socket.IO events consistently invoke the isSocketAdminAuthorized() function regardless of the secureEnabled configuration state. Additionally, monitoring for unauthorized access attempts to the DAQ_QUERY endpoint should be implemented to detect potential exploitation attempts. System administrators should also consider implementing zero-trust network principles and regularly reviewing access controls to prevent similar inconsistencies in other application components that might present analogous security weaknesses.