Description

A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized() to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T11:17:31.637Z",
  "pubdate": "2026-08-10T11:17:31.637Z",
  "executiveSummary": "A missing authentication vulnerability exists in frangoteam/FUXA through version 1.3.3, specifically within the Socket.IO communication handler. The flaw enables unauthenticated remote attackers to bypass access controls and query all historical sensor data by interacting directly with the DAQ_QUERY Socket.IO event. While other sensitive administrative events properly invoke authorization checks when secureEnabled=true is configured, the DAQ_QUERY handler entirely omits this security validation. This exposes sensitive operational technology and industrial automation telemetry to unauthorized third parties over the network. The risk implications include severe information disclosure, loss of confidentiality regarding process data, and potential reconnaissance opportunities for subsequent attacks against industrial control environments. Exploitation requires network access to the FUXA instance and the ability to emit Socket.IO events, with no prior authentication or administrative privileges required.",
  "technicalDetails": "The vulnerability stems from an authorization bypass flaw in the Socket.IO event handling architecture of frangoteam/FUXA through 1.3.3. Within the application backend, sensitive administrative and operational events such as DEVICE_BROWSE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST are designed to enforce security controls by invoking the isSocketAdminAuthorized() function to validate connection tokens when secureEnabled=true. However, the DAQ_QUERY event handler located in the vulnerable file server/runtime/index.js fails to implement this authorization check entirely.\nThe attack flow proceeds over the network via the Socket.IO protocol. An unauthenticated remote attacker establishes a connection to the target FUXA server. Instead of providing valid administrative credentials or a session token, the attacker directly emits the DAQ_QUERY Socket.IO event payload. Because server/runtime/index.js processes this incoming event without validating the connection state or invoking isSocketAdminAuthorized(), the server implicitly trusts the request.\nUpon receiving the unauthorized payload, the vulnerable component queries the underlying data acquisition (DAQ) storage and retrieves historical sensor data. The application then serializes and transmits the historical telemetry back to the unauthenticated socket client. This grants the remote attacker full visibility into historical process variables, sensor readings, and operational metrics without requiring any authentication credentials or elevated privileges.\nThe affected product is frangoteam/FUXA across all versions up to and including 1.3.3. The vulnerability is exploitable remotely over any network path that can reach the FUXA Socket.IO interface. Post-exploitation impact is characterized by unauthorized data exfiltration of sensitive industrial sensor history, enabling malicious actors to map facility operations, analyze production cycles, and gather intelligence for targeted follow-up exploits."
}