CVE-2026-67440: FUXA Information Disclosure Vulnerability

CVE-2026-67440 Overview

FUXA is a web-based Process Visualization software used for SCADA, HMI, and dashboard deployments. CVE-2026-67440 is a missing authorization vulnerability [CWE-862] affecting FUXA versions 1.3.2 and earlier. The DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without invoking isSocketAdminAuthorized when secureEnabled is set to true. Remote unauthenticated or guest users can invoke these Socket.IO events and collect system-discovery information not required for normal public HMI viewing. The issue is fixed in version 1.3.3.

Critical Impact
Unauthenticated remote attackers can enumerate SCADA device topology, node attributes, host network interfaces, and device tags over Socket.IO, exposing internal industrial control system metadata.

Affected Products

FUXA versions 1.3.2 and earlier
FUXA SCADA/HMI/Dashboard server component (server/runtime/index.js)
Deployments with secureEnabled set to true

Discovery Timeline

2026-08-18 - CVE-2026-67440 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-67440

Vulnerability Analysis

FUXA exposes runtime functionality to browser clients via Socket.IO events. When secureEnabled is active, administrative events are supposed to enforce access control through the isSocketAdminAuthorized check. Four metadata-oriented handlers omit this check entirely.

The affected events are DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST. These handlers return device-discovery data, protocol node attributes, host network interface listings, and device tag metadata. Because ordinary device status, value, alarm, and dashboard events are intentionally public for HMI viewing, the authorization gap on discovery events blends into legitimate traffic.

Root Cause

The root cause is missing authorization enforcement [CWE-862] in Socket.IO event handlers within server/runtime/index.js. Public HMI viewing requires read access to runtime values, so the developers explicitly kept those handlers open. The four metadata handlers were incorrectly grouped with public handlers instead of admin-authorized handlers. The fix in version 1.3.3 adds the isSocketAdminAuthorized check to these handlers.

Attack Vector

An attacker connects to a reachable FUXA server over the network and establishes a Socket.IO session as an unauthenticated or guest user. The attacker emits any of the four affected events and receives structured metadata about the underlying industrial network. Returned data can include device identifiers, protocol node hierarchies, tag names, and host interface addresses that support follow-on lateral movement or targeting of PLC and field devices.

typescript

// Security patch in client/src/app/_services/auth.service.ts
// Hardening for JWT lifecycle and Socket.IO admin operations (#2379)
         return false;
     }
 
-	setNewToken(token: string) {
+	setNewToken(token: string, userData?: Partial<UserProfile>) {
 		if (!this.currentUser) {
 			return;
 		}
+		if (userData) {
+			this.currentUser.username = userData.username ?? this.currentUser.username;
+			this.currentUser.fullname = userData.fullname ?? this.currentUser.fullname;
+			this.currentUser.groups = userData.groups ?? this.currentUser.groups;
+			this.currentUser.info = userData.info ?? this.currentUser.info;
+			if (this.currentUser.info) {
+				this.currentUser.infoRoles = JSON.parse(this.currentUser.info)?.roles;
+			} else {
+				this.currentUser.infoRoles = null;
+			}
+		}
 		this.currentUser.token = token;
 		this.saveUserToken(this.currentUser);
+		this.currentUser$.next(this.currentUser);
 	}

Source: GitHub Commit 4fa47d0

Detection Methods for CVE-2026-67440

Indicators of Compromise

Socket.IO events named DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, or DEVICE_TAGS_REQUEST originating from unauthenticated or guest sessions
Repeated Socket.IO enumeration requests from a single client IP against the FUXA server port
Guest tokens issued to clients that subsequently emit administrative discovery events

Detection Strategies

Enable verbose Socket.IO server logging and correlate event names against session authentication state
Alert when the four affected event names are received on sessions lacking admin authorization
Baseline expected Socket.IO event traffic per client role and flag deviations

Monitoring Recommendations

Monitor outbound responses from the FUXA server for payloads containing host interface data or device tag lists sent to non-admin sessions
Track network access to FUXA server ports from untrusted network segments
Review web server and reverse proxy logs for Socket.IO handshake requests preceding the affected event names

How to Mitigate CVE-2026-67440

Immediate Actions Required

Upgrade FUXA to version 1.3.3 or later, which restores isSocketAdminAuthorized enforcement on the affected handlers
Restrict network access to FUXA server instances to trusted operator networks only
Audit existing accounts and revoke unused guest sessions

Patch Information

The fix is delivered in FUXA release 1.3.3. The change adds admin authorization checks to the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js and hardens the JWT and Socket.IO admin lifecycle on the client. See the GitHub Security Advisory GHSA-rh5p-m38p-2w75, the GitHub Pull Request Discussion, and the GitHub Release v1.3.3.

Workarounds

Place FUXA behind a reverse proxy that enforces authentication on all Socket.IO paths until the upgrade is applied
Disable guest access and require authenticated sessions when secureEnabled is true
Segment the FUXA host into an operational technology (OT) network zone with strict firewall rules blocking untrusted sources

bash

# Verify installed FUXA version and upgrade to 1.3.3
npm ls fuxa
npm install fuxa@1.3.3
# Restart the FUXA service after upgrade
systemctl restart fuxa