CVE-2026-65985: FUXA: SSRF hardening for `device-webapi-request`
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or HTTPS request and return the response body to the requesting socket. The attacker can use the server as a read SSRF oracle against reachable internal services or cloud metadata endpoints, with impact depending on the FUXA host's deployment network. This issue is fixed in version 1.3.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FUXAto a version that resolves this vulnerability.Fixed in 1.3.3
Event History
Frequently Asked Questions
Which versions require remediation?
FUXA 1.3.2 and earlier are affected. The issue is fixed in version 1.3.3.
What level of access does an attacker need to exploit this?
An attacker needs an authenticated non-admin runtime user account and access to the Socket.IO handler. They can cause the FUXA server to make HTTP or HTTPS requests to destinations reachable from the FUXA host and receive the response body.
Which deployments are most at risk?
Exposure is greatest where the FUXA host can reach internal services or cloud metadata endpoints. The practical impact depends on the network reachable from that host.