CVE-2026-67440: FUXA: Unauthenticated Socket.IO read events
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICEBROWSE, DEVICENODEATTRIBUTE, HOSTINTERFACES, and DEVICETAGSREQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FUXAto a version that resolves this vulnerability.Fixed in 1.3.3 - Configuration
In server/runtime/index.js ensure that DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST do not return device-discovery/node-attribute/host-network-interface/device-tag metadata unless isSocketAdminAuthorized is true (the flaw affects versions 1.3.2 and earlier when secureEnabled is true).
FUXA server (server/runtime/index.js) Socket.IO handlers isSocketAdminAuthorized enforcement for handlers = authorized-only (no metadata for unauthenticated/guest users)
Event History
Frequently Asked Questions
Which deployments are exposed?
FUXA instances running version 1.3.2 or earlier are affected when secureEnabled is true. Remote unauthenticated or guest users can access the affected Socket.IO handlers.
What does an attacker need to exploit this issue?
An attacker only needs network access to the FUXA Socket.IO service and does not need administrator authorization. They can request device-discovery data, node attributes, host network interfaces, and device-tag metadata.
What should teams do if they cannot patch immediately?
Upgrade FUXA to version 1.3.3, which fixes the missing authorization checks. If an upgrade cannot be performed immediately, restrict untrusted network access to the Socket.IO service to prevent unauthenticated or guest users from invoking the affected events.
How can I determine whether my instance is affected?
Review whether unauthenticated or guest Socket.IO clients can invoke DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, or DEVICE_TAGS_REQUEST and receive metadata. Successful responses containing device, node, host-interface, or tag information indicate exposure.