CVE-2026-47717: FUXA Information Disclosure Vulnerability

CVE-2026-47717 Overview

CVE-2026-47717 is an information disclosure vulnerability in FUXA, a web-based Process Visualization (SCADA/HMI/Dashboard) software maintained by frangoteam. In fuxa-server version 1.3.0, the GET /api/project endpoint returns sensitive project configuration data to guest-context requests. The exposure occurs even when the secureEnabled option is enabled. An unauthenticated network attacker can retrieve project definitions that describe control system topology, tags, device connections, and dashboard configuration. The issue is tracked under [CWE-201: Insertion of Sensitive Information Into Sent Data] and is resolved in FUXA version 1.3.1.

Critical Impact
Unauthenticated remote attackers can retrieve full SCADA/HMI project configuration data from exposed FUXA 1.3.0 servers, enabling reconnaissance of industrial control system assets.

Affected Products

FUXA fuxa-server version 1.3.0
FUXA deployments with secureEnabled set to true (still vulnerable prior to 1.3.1)
Web-based SCADA/HMI/Dashboard instances exposed on internal or public networks

Discovery Timeline

2026-08-12 - CVE-2026-47717 published to NVD
2026-08-12 - Last updated in NVD database
Fix released - FUXA v1.3.1 release and GHSA-q3w6-q3hc-c5x6 advisory

Technical Details for CVE-2026-47717

Vulnerability Analysis

FUXA exposes a REST endpoint at GET /api/project that returns the current project configuration used by the SCADA/HMI runtime. In version 1.3.0, the endpoint does not enforce the authenticated-session requirement expected under secureEnabled mode. Requests arriving without a valid user context are treated as guest and receive the full response body. The returned project object typically contains device connection parameters, tag definitions, view layouts, scripts, and alarm configurations. Attackers use this data to map industrial assets, identify PLCs and protocols in use, and plan follow-on attacks against connected controllers. The vulnerability is remotely exploitable over the network without user interaction.

Root Cause

The root cause is a missing authorization check on the project retrieval route in fuxa-server 1.3.0. The secureEnabled flag was expected to gate access to sensitive endpoints, but the handler for /api/project did not consult the authentication middleware for guest requests. This aligns with [CWE-201], where an application inserts sensitive information into a response that should have been restricted to authorized principals.

Attack Vector

Exploitation requires only network reachability to the FUXA HTTP service. An attacker issues an unauthenticated GET request against /api/project and parses the returned JSON project definition. No credentials, tokens, or user interaction are required. In deployments where FUXA is reachable from the internet or an untrusted OT network segment, the endpoint discloses the complete SCADA project without generating authentication failures.

No verified public exploit code is available. See the GHSA-q3w6-q3hc-c5x6 advisory for maintainer details.

Detection Methods for CVE-2026-47717

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/project on FUXA servers in access logs
Successful 200 OK responses to /api/project from source IPs without a preceding successful login sequence
Anomalous large JSON responses returned from /api/project to external or non-operator IP ranges

Detection Strategies

Review reverse proxy or FUXA application logs for /api/project requests that lack a session cookie or Authorization header
Correlate /api/project access with the source IP's authentication history; flag requests from IPs that never authenticated
Alert on any access to FUXA API endpoints from outside defined operator or engineering workstation subnets

Monitoring Recommendations

Forward FUXA and fronting web server logs to a centralized SIEM for retention and query
Baseline expected clients of the FUXA API and alert on new source IPs interacting with /api/*
Monitor network flows between the SCADA host and untrusted zones for unexpected outbound project data transfers

How to Mitigate CVE-2026-47717

Immediate Actions Required

Upgrade FUXA to version 1.3.1 or later on all fuxa-server deployments
Restrict network access to the FUXA management interface to authorized operator workstations only
Audit historical access logs for prior unauthenticated requests to /api/project and rotate any exposed device credentials referenced in project files

Patch Information

FUXA version 1.3.1 fixes the missing authorization check on GET /api/project. Details are published in GitHub Security Advisory GHSA-q3w6-q3hc-c5x6 and the v1.3.1 release notes. Operators should validate that secureEnabled is set to true after upgrading and confirm that guest requests to /api/project receive an authentication error.

Workarounds

Place FUXA behind a reverse proxy that enforces authentication or IP allowlisting for /api/* routes until the upgrade is applied
Segment the SCADA host into an isolated OT network zone with no direct exposure to corporate or internet networks
Block external access to the FUXA HTTP port at the perimeter firewall pending patch deployment

bash

# Example nginx reverse proxy allowlist for FUXA API endpoints
location /api/ {
    allow 10.10.20.0/24;   # operator workstation subnet
    allow 10.10.30.0/24;   # engineering workstation subnet
    deny all;
    proxy_pass http://127.0.0.1:1881;
}