Server-Side Request Forgery in FUXA SCADA Software

Executive Summary

CVE-2026-65985 is a Server-Side Request Forgery (SSRF) vulnerability in FUXA software versions up to 1.3.2. It allows an authenticated non-admin runtime user to control the property.address parameter in the device-webapi-request Socket.IO handler, causing the FUXA server to make outbound HTTP or HTTPS requests to arbitrary URLs. The server then returns the response body to the attacker's socket.

This issue is classified as a hardening problem in secure deployments where secureEnabled=true. The vulnerability enables attackers to use the FUXA server as a read SSRF oracle against internal services or cloud metadata endpoints, depending on the host's network configuration.

Useful 0 Not Useful 0

Detection Guidance

Check FUXA version with: npm list -g fuxa or cat /path/to/FUXA/package.json | grep version. If version <=1.3.2, the system is vulnerable. Monitor network traffic for unexpected outbound HTTP/HTTPS requests from the FUXA server, especially to internal or cloud metadata endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an authenticated attacker to make the FUXA server send requests to internal systems or cloud services. The attacker can read responses from these systems, potentially exposing sensitive data or internal network information. The impact depends on what services the FUXA server can access.

Exploitation requires an authenticated FUXA user account but does not require admin privileges. The attacker could target cloud metadata endpoints to obtain credentials or access internal APIs, databases, or other services reachable from the FUXA server.

Useful 0 Not Useful 0

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. If exploited, it may result in data breaches exposing personal or health information, leading to compliance violations and potential regulatory penalties.

Organizations using FUXA in regulated environments must ensure they upgrade to version 1.3.3 or later to mitigate this risk. Failure to address this vulnerability could result in non-compliance with data protection standards and increased exposure to legal and financial consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade FUXA to version 1.3.3 or later immediately. If upgrading is not possible, restrict access to the device-webapi-request Socket.IO handler to admin users only by modifying server/runtime/index.js. Ensure secureEnabled=true is set in FUXA configuration to enforce stricter access controls.

Useful 0 Not Useful 0