/Vulnerability Library

FUXA 1.3.0 - Unauthenticated ICS/SCADA Project Data Disclosure

CVE-2026-47717
Verified

Description

FUXA v1.3.0 exposes full SCADA/HMI project configuration via GET /api/project without authentication, even when secureEnabled is true. The secureFnc middleware auto-generates a valid guest JWT when no token is provided, bypassing authentication. Exposed data includes server-side scripts, device configs, HMI views, and alarm definitions.

Severity

High

CVSS Score

7.5

Exploit Probability

1%

Affected Product

fuxa

Published Date

June 18, 2026

Template Author

pussycat0x

CVE-2026-47717.yaml
7.5Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2026-47717
CWE ID:
cwe-201

References

https://github.com/advisories/GHSA-q3w6-q3hc-c5x6https://www.miggo.io/vulnerability-database/cve/CVE-2026-47717

Remediation Steps

Upgrade to fuxa-server version 1.3.1 or later.