CVE-2026-47719

Received Received - Intake

FUXA SSRF via Socket.IO Handlers Prior to 1.3.2

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: GitHub, Inc.

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices/httprequest/index.js call axios.get against arbitrary HTTP or HTTPS destinations, connect to reachable OPC UA or ODBC services, and receive results through the corresponding Socket.IO event. This read SSRF oracle can expose cloud instance metadata, internal administrative services, industrial endpoints, and ODBC data reachable from the FUXA host, including when secureEnabled is true. This issue is fixed in version 1.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-18

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-08-19

EPSS Evaluated

N/A

NVD

CVE-2026-47719

Affected Vendors & Products

Vendor	Product	Version / Range
fuxa	fuxa	to 1.3.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

CVE-2026-47719 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in FUXA versions before 1.3.2. It affects two Socket.IO handlers, DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY, which lack proper authorization checks. Attackers can exploit these to send arbitrary HTTP/HTTPS requests to internal or external services, including OPC UA or ODBC endpoints, and receive responses through Socket.IO events. This allows reading sensitive data like cloud metadata or internal service responses.

Detection Guidance

To detect this vulnerability, monitor network traffic for unusual Socket.IO connections to FUXA instances. Check for unauthorized requests to internal or external services via DEVICE_WEBAPI_REQUEST or DEVICE_PROPERTY handlers. Inspect logs for repeated failed authorization attempts on these endpoints.

Impact Analysis

This vulnerability allows remote unauthenticated attackers to make the FUXA server connect to arbitrary internal or external services. They can exfiltrate sensitive data such as cloud instance metadata, internal administrative service responses, industrial endpoints, or ODBC data accessible from the FUXA host. It may also enable access to internal systems or services reachable from the server.

Compliance Impact

This SSRF vulnerability could lead to unauthorized data exposure, violating GDPR's data protection principles or HIPAA's requirements for safeguarding protected health information. Unauthorized access to internal services or data exfiltration may result in compliance breaches, legal penalties, or reputational damage due to compromised sensitive information.

Mitigation Strategies

Immediately upgrade FUXA to version 1.3.2 or later. If upgrading is not possible, restrict network access to FUXA instances, disable Socket.IO handlers for DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY, and implement allowlist validation for target addresses.

Hi! I’m here to help you understand CVE-2026-47719. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70