CVE-2026-47719: FUXA SCADA Software SSRF Vulnerability

CVE-2026-47719 Overview

CVE-2026-47719 is a Server-Side Request Forgery (SSRF) vulnerability in FUXA, a web-based Process Visualization (SCADA/HMI/Dashboard) platform. Versions prior to 1.3.2 expose the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js without invoking isSocketWriteAuthorized. A remote unauthenticated attacker can supply attacker-controlled property.address or endpoint connection data and cause the server to issue axios.get requests to arbitrary HTTP or HTTPS destinations. The flaw also permits connections to reachable OPC UA and ODBC services, with results returned through the corresponding Socket.IO event. The issue is tracked as [CWE-918] and fixed in version 1.3.2.

Critical Impact
Unauthenticated attackers can pivot from the FUXA server to cloud metadata services, internal admin interfaces, and industrial endpoints, even when secureEnabled is true.

Affected Products

FUXA versions prior to 1.3.2
FUXA deployments with secureEnabled=true (still vulnerable)
FUXA instances exposing Socket.IO to untrusted networks

Discovery Timeline

2026-08-18 - CVE-2026-47719 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-47719

Vulnerability Analysis

The vulnerability resides in FUXA's Socket.IO event dispatcher in server/runtime/index.js. The handlers for DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY process incoming client messages without checking whether the connected socket is authorized to write. Because Socket.IO connections in vulnerable versions do not require authentication for these events, any remote client that can reach the FUXA Socket.IO endpoint can trigger the handlers.

When the DEVICE_WEBAPI_REQUEST handler is invoked, FUXA passes attacker-controlled connection details to server/runtime/devices/httprequest/index.js, which calls axios.get against the supplied URL. The response is then broadcast through the corresponding Socket.IO event, forming a read-oriented SSRF oracle. The DEVICE_PROPERTY handler additionally accepts arbitrary endpoint parameters, enabling probes against OPC UA and ODBC services reachable from the FUXA host.

Root Cause

The root cause is missing authorization enforcement. The two handlers omit calls to isSocketWriteAuthorized(socket) before acting on client-supplied data. As a result, guest sockets are treated as trusted, and responses are broadcast via io.emit rather than scoped to the requesting socket.

Attack Vector

An attacker who can reach the FUXA Socket.IO listener connects as an unauthenticated client, emits a crafted DEVICE_WEBAPI_REQUEST or DEVICE_PROPERTY event with attacker-controlled addresses, and receives the server's outbound response. This exposes cloud instance metadata services (for example, 169.254.169.254), internal administrative dashboards, industrial control endpoints, and ODBC data sources reachable from the FUXA host.

javascript

// Patch applied in server/runtime/index.js (commit 7b2088e)
// Adds isSocketWriteAuthorized check and scopes replies to the requesting socket
socket.on(Events.IoEventTypes.DEVICE_PROPERTY, (message) => {
    try {
        if (!isSocketWriteAuthorized(socket)) {
            logger.warn(`${Events.IoEventTypes.DEVICE_PROPERTY}: unauthorized request from ${socket.userId || 'guest'}`);
            return;
        }
        if (message && message.endpoint && message.type) {
            devices.getSupportedProperty(message.endpoint, message.type).then(result => {
                message.result = result;
                socket.emit(Events.IoEventTypes.DEVICE_PROPERTY, message);
            }).catch(function (err) {
                logger.error(`${Events.IoEventTypes.DEVICE_PROPERTY}: ${err}`);
                message.error = err;
                socket.emit(Events.IoEventTypes.DEVICE_PROPERTY, message);
            });
        } else {
            logger.error(`${Events.IoEventTypes.DEVICE_PROPERTY}: wrong message`);
            message = message || {};
            message.error = 'wrong message';
            socket.emit(Events.IoEventTypes.DEVICE_PROPERTY, message);
        }
    } catch (err) {
        logger.error(`${Events.IoEventTypes.DEVICE_PROPERTY}: ${err}`);
    }
});
// Source: https://github.com/frangoteam/FUXA/commit/7b2088eaae2be318d962dcba34bfc7a7f26837bd

Detection Methods for CVE-2026-47719

Indicators of Compromise

Outbound HTTP or HTTPS requests from the FUXA host to cloud metadata endpoints such as 169.254.169.254 or metadata.google.internal.
FUXA process connections to internal OPC UA (TCP/4840) or ODBC endpoints not present in the configured device inventory.
Socket.IO traffic containing DEVICE_WEBAPI_REQUEST or DEVICE_PROPERTY events from unauthenticated or guest sessions.
Unexpected axios.get activity originating from server/runtime/devices/httprequest/index.js.

Detection Strategies

Inspect FUXA application logs for repeated DEVICE_WEBAPI_REQUEST or DEVICE_PROPERTY events tied to guest user identifiers.
Baseline the FUXA host's outbound network destinations and alert on connections outside the SCADA network segment.
Deploy egress filtering rules that flag requests to link-local metadata addresses from the FUXA server.

Monitoring Recommendations

Forward FUXA logs and host network telemetry to a centralized analytics platform for correlation.
Monitor Socket.IO connection counts and event volumes for anomalies indicating scripted abuse.
Alert on any process on the FUXA host that opens sockets to internal administrative subnets not required for operations.

How to Mitigate CVE-2026-47719

Immediate Actions Required

Upgrade FUXA to version 1.3.2 or later, which enforces isSocketWriteAuthorized on the affected handlers.
Restrict network exposure of the FUXA Socket.IO listener to trusted management networks only.
Enforce egress filtering on the FUXA host to block traffic to cloud metadata services and unrelated internal ranges.
Rotate any credentials or tokens that may have been retrievable from cloud instance metadata during the exposure window.

Patch Information

The fix is delivered in commit 7b2088e and released as FUXA v1.3.2. See the GitHub Security Advisory GHSA-w86f-rf9w-h3x6, Pull Request #2344, and the v1.3.2 release notes. Verify the deployed version by checking the FUXA package metadata after upgrade.

Workarounds

Place FUXA behind an authenticating reverse proxy that terminates Socket.IO connections from untrusted clients.
Apply host-based firewall rules that deny outbound access from the FUXA process to link-local and internal management CIDRs.
Segment the FUXA host from OPC UA and ODBC assets that do not require direct connectivity.

bash

# Example: block link-local metadata access from the FUXA host (Linux iptables)
iptables -A OUTPUT -m owner --uid-owner fuxa -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner fuxa -d 169.254.0.0/16 -j DROP

# Verify installed FUXA version after upgrade
npm ls @frangoteam/fuxa || cat /opt/fuxa/package.json | grep '"version"'