CVE-2026-47720: FUXA SCADA Software SQLi Vulnerability

CVE-2026-47720 Overview

FUXA is a web-based Process Visualization software used for SCADA, HMI, and dashboard deployments in industrial environments. CVE-2026-47720 is a SQL injection vulnerability [CWE-89] in the TDengine data acquisition (DAQ) storage connector. The escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but fails to escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through the GET /api/daq endpoint or the DAQ_QUERY Socket.IO event. TDengine then interprets the backslash and quote sequence as SQL syntax, allowing extraction of every row from fuxa.meters. The issue is fixed in FUXA version 1.3.2.

Critical Impact
Unauthenticated attackers can exfiltrate historical PLC tag values, device identifiers, and device names from the TDengine backing store even when FUXA authentication is enabled.

Affected Products

FUXA (frangoteam/FUXA) versions prior to 1.3.2
Deployments using the TDengine DAQ storage connector
FUXA instances exposing /api/daq or Socket.IO endpoints to untrusted networks

Discovery Timeline

2026-08-18 - CVE-2026-47720 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-47720

Vulnerability Analysis

The vulnerability resides in the string escaping helper used before composing SQL queries against the TDengine time-series database. The escapeTdString function attempts to neutralize embedded single quotes by doubling them, which is the standard TDengine quoting convention. It does not, however, escape backslash characters. An attacker who supplies a payload containing \' produces output where the doubled quotes are preceded by a backslash. TDengine parses the backslash as an escape prefix, consuming one of the doubled quotes and leaving the other to terminate the string literal. The remainder of the attacker-controlled payload is then interpreted as SQL. Because the vulnerable path is reachable through both GET /api/daq and the Socket.IO DAQ_QUERY event, and neither requires authentication, any network-reachable FUXA server is exposed regardless of the application's login configuration.

Root Cause

The root cause is incomplete input sanitization in escapeTdString. The function handles single quotes but omits backslash escaping, breaking the invariant that all attacker-influenced string content remains inside the intended literal. This is a classic SQL Injection [CWE-89] pattern.

Attack Vector

The attacker sends a crafted sids parameter through either the REST endpoint GET /api/daq or the DAQ_QUERY Socket.IO event. The payload uses a backslash-quote sequence to escape the enclosing string literal. The injected fragment produces a query that returns every row from fuxa.meters, disclosing historical PLC tag values, device identifiers, and device names.

javascript

// Security patch in server/runtime/storage/tdengine/index.js
// fix: tdengine string escaping (#2343)
 function escapeTdString(value) {
-    return String(value).replace(/'/g, "''");
+    return String(value).replace(/\\/g, "\\\\").replace(/'/g, "''");
 }
 
 function TDengine(_settings, _log, _currentStorage) {
// Source: https://github.com/frangoteam/FUXA/commit/b78f6159d02a56ce5ff48207feb936afb3534fc8

Detection Methods for CVE-2026-47720

Indicators of Compromise

HTTP requests to /api/daq containing backslash characters, single quotes, or SQL keywords (UNION, SELECT, --) inside the sids parameter.
Socket.IO DAQ_QUERY events with sids values containing \' sequences or unexpected SQL tokens.
Anomalous TDengine query logs referencing fuxa.meters with unusually broad result sets.

Detection Strategies

Inspect FUXA application logs and reverse-proxy access logs for sids values containing backslashes or quote characters.
Correlate spikes in TDengine query volume or response size against fuxa.meters with inbound requests to /api/daq.
Deploy web application firewall rules that block SQL metacharacters in the sids query parameter.

Monitoring Recommendations

Enable verbose query logging on the TDengine instance backing FUXA and forward logs to a central store for review.
Baseline the volume and shape of /api/daq requests and alert on outliers in payload length or non-numeric sids content.
Monitor outbound network flows from FUXA hosts for unusual data egress patterns following DAQ queries.

How to Mitigate CVE-2026-47720

Immediate Actions Required

Upgrade FUXA to version 1.3.2 or later, which includes commit b78f615 fixing escapeTdString.
Restrict network exposure of FUXA HTTP and Socket.IO endpoints to trusted operator networks only.
Review TDengine audit logs for prior queries against fuxa.meters that may indicate exploitation.

Patch Information

The fix is available in FUXA Release v1.3.2. The corrective change is described in the GitHub Security Advisory GHSA-h9fj-c2qr-76g2 and implemented in Pull Request #2343. The patched escapeTdString function now escapes backslashes before doubling single quotes, closing the injection primitive.

Workarounds

Place FUXA behind a reverse proxy or WAF that rejects requests containing backslash or quote characters in the sids parameter.
Enforce network-layer access controls that limit /api/daq and Socket.IO reachability to authenticated operator workstations.
If the TDengine DAQ connector is not required, disable it in FUXA storage settings until the upgrade to 1.3.2 is deployed.

bash

# Example nginx location block rejecting suspicious sids values
location /api/daq {
    if ($arg_sids ~* "[\\'\"]|--|union|select") {
        return 400;
    }
    proxy_pass http://fuxa_backend;
}