Vulnerability Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag metadata without isSocketAdminAuthorized when secureEnabled is true. A remote unauthenticated or guest user can invoke these metadata-oriented Socket.IO events and collect system-discovery information that is not required for normal public HMI viewing, while ordinary device status, value, alarm, and dashboard events remain intentionally public. This issue is fixed in version 1.3.3.
Related Weaknesses (CWE)
References
- https://github.com/frangoteam/FUXA/commit/4fa47d0a2a856ed34f427f472fb4450f86e774
- https://github.com/frangoteam/FUXA/pull/2379
- https://github.com/frangoteam/FUXA/releases/tag/v1.3.3
- https://github.com/frangoteam/FUXA/security/advisories/GHSA-rh5p-m38p-2w75
FAQ
What is CVE-2026-67440?
CVE-2026-67440 is a documented vulnerability. FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/ru...
How severe is CVE-2026-67440?
CVSS scoring is not yet available for CVE-2026-67440. Check NVD for updates.
Is there a patch for CVE-2026-67440?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.