CVE-2026-72586: frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket.IO Event Handler
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQQUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICEBROWSE, HOSTINTERFACES, DEVICETAGSREQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQQUERY handler in server/runtime/index.js lacks this check entirely.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network access to the Socket.IO endpoint used by FUXA (e.g., limit reachability to trusted hosts via firewall/ACL) to reduce exposure of the unauthenticated DAQ_QUERY Socket.IO event in versions through 1.3.3.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72586?
CVE-2026-72586 has a severity rating of high with a score of 7.5.
How do I fix CVE-2026-72586?
To fix CVE-2026-72586, implement proper authentication mechanisms for the DAQ_QUERY Socket.IO event handler.
What systems are affected by CVE-2026-72586?
CVE-2026-72586 affects versions up to 1.3.3 of frangoteam/FUXA.
Can CVE-2026-72586 be exploited remotely?
Yes, CVE-2026-72586 can be exploited by unauthenticated remote attackers.
What data can be accessed due to CVE-2026-72586?
CVE-2026-72586 allows attackers to query all historical sensor data.