frangoteam FUXA up to 1.3.1 TDengine DAQ storage connector index.js escapeTdString sids sql injection

Summaryinfo

A vulnerability described as critical has been identified in frangoteam FUXA up to 1.3.1. This issue affects the function escapeTdString of the file server/runtime/storage/tdengine/index.js of the component TDengine DAQ storage connector. The manipulation of the argument sids results in sql injection. This vulnerability is identified as CVE-2026-47720. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in frangoteam FUXA up to 1.3.1. It has been classified as critical. Affected is the function escapeTdString of the file server/runtime/storage/tdengine/index.js of the component TDengine DAQ storage connector. The manipulation of the argument sids with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-47720 since 05/19/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 1.3.2 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• frangoteam

Name

• FUXA

Version

• 1.3.0
• 1.3.1

Website

• Product: https://github.com/frangoteam/FUXA/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion