Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-12T23:17:20.643Z",
  "pubdate": "2026-08-12T23:17:20.643Z",
  "executiveSummary": "A sensitive data exposure vulnerability exists in the FUXA web-based Process Visualization (SCADA/HMI/Dashboard) software, specifically within fuxa-server version 1.3.0. The vulnerability allows unauthenticated guest-context requests to access and retrieve sensitive project configuration data via the GET /api/project endpoint, even when authentication mechanisms such as secureEnabled are explicitly activated. This flaw introduces significant risk implications for industrial control and visualization environments by leaking internal application architectures and configuration parameters to unauthorized external entities. An attacker operating in a guest context can exploit this flaw remotely over the network without requiring any prior authentication credentials or elevated privileges. Successful exploitation compromises the confidentiality of the SCADA/HMI deployment, potentially facilitating further targeted attacks against the underlying industrial infrastructure. Remediation requires updating the affected software to version 1.3.1, which introduces the necessary access control enforcement to secure the vulnerable endpoint against unauthorized retrieval attempts.",
  "technicalDetails": "The vulnerability resides within the fuxa-server component of the FUXA Process Visualization software, specifically affecting version 1.3.0. The root cause of the issue stems from improper access control enforcement on the GET /api/project endpoint. In secure deployments where the secureEnabled configuration parameter is enabled, administrative intent dictates that sensitive internal application state and project configuration data should be restricted to authenticated and authorized sessions only. However, the endpoint fails to properly validate the session context or enforce authorization checks for incoming requests originating from a guest context. Consequently, unauthenticated network clients can issue a standard HTTP GET request directly to the vulnerable API endpoint and receive a complete payload containing sensitive project configuration data in the response body. The attack flow involves a remote threat actor interacting with the exposed web interface and querying the unauthenticated API route over the network. Because the server processes the request and bypasses requisite privilege validation checks, the confidentiality boundary protecting the SCADA/HMI project parameters is effectively circumvented. No specialized privileges, pre-existing access tokens, or complex payload manipulation are required to trigger the flaw, as the vulnerable component inherently permits unauthenticated retrieval. The post-exploitation impact includes the unauthorized collection of sensitive operational technology design details, asset naming conventions, network mappings, and potentially hardcoded credentials or communication parameters embedded within the project files, which can subsequently be leveraged by attackers to mount advanced secondary attacks against the ICS or SCADA environment."
}