What’s Vulnerable › Vulnerabilities

CVE-2026-67440: FUXA: Unauthenticated Socket.IO read events

• Severity: medium (CVSS 6.9 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-18 · updated 2026-10-22
• Weakness: CWE-862

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.

Affected products

• frangoteam FUXA: before 1.3.3

References

• https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed34f427f472fb4450f86e7749b
• https://github.com/frangoteam/FUXA/pull/2379
• https://github.com/frangoteam/FUXA/releases/tag/v1.3.3
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-rh5p-m38p-2w75

Get alerted when CVE-2026-67440 or the next vulnerability affects your stack