CVE-2026-47718: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47718 is an authentication bypass vulnerability in FUXA, a web-based SCADA/HMI/Dashboard Process Visualization software developed by frangoteam. When secureEnabled=true, FUXA version 1.3.0-2773 still permits guest and invalid-token requests to access protected read APIs for project data, alarms, and scheduler information. The vulnerability was published on May 26, 2026, and patched in version 1.3.1. It carries a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, FUXA Advisory).

The root cause lies in server/api/jwt-helper.js, where the verifyToken() function incorrectly converts missing-token or invalid-token states into a guest context rather than rejecting the request outright (CWE-287: Improper Authentication, CWE-862: Missing Authorization). API route handlers in server/api/projects/index.js, server/api/alarms/index.js, and server/api/scheduler/index.js then accept this guest context and return sensitive data even in secure mode. The attack requires no privileges, no user interaction, and is exploitable remotely over the network with low complexity, making it automatable (Github Advisory, FUXA Advisory).

Successful exploitation allows unauthenticated attackers to read project metadata, alarm configurations, and scheduler information from FUXA instances that operators believe are protected by secure mode. In industrial/OT environments, this disclosure can facilitate reconnaissance for follow-on attacks against SCADA/HMI systems, potentially exposing process topology, alarm thresholds, and scheduled automation tasks. Confidentiality and limited integrity impacts are confirmed, with no direct availability impact (Github Advisory).

A proof-of-concept (PoC) has been confirmed by the reporter (north-echo) and tested against isolated lab instances; the exact HTTP requests and PoC script can be provided upon request. The NVD SSVC assessment classifies exploitation as "poc" and the vulnerability as "automatable," meaning it can be scripted at scale. The EPSS score is approximately 0.089%–0.271% (19th percentile), and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (Github Advisory, FUXA Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FUXA instances running version 1.3.0-2773 using tools like Shodan (search for FUXA web interface banners) or by scanning for the default FUXA HTTP port.
2. Verify secure mode: Attempt a basic unauthenticated GET /api/project request. A 200 OK response with project data confirms the instance is vulnerable even if secureEnabled=true.
3. Enumerate protected APIs: Send unauthenticated HTTP GET requests to the following endpoints without any x-access-token header:
   • GET /api/project
   • GET /api/alarms
   • GET /api/scheduler?id=test
4. Bypass with invalid token: Optionally, send the same requests with a deliberately invalid x-access-token header value. The server will still return 200 OK with sensitive data due to the flawed verifyToken() logic.
5. Collect intelligence: Parse the returned JSON responses to extract project metadata (device topology, tag names), alarm configurations, and scheduler task details for use in follow-on attacks against the industrial environment (Github Advisory, FUXA Advisory).

• Network: Unexpected unauthenticated HTTP GET requests to /api/project, /api/alarms, or /api/scheduler from external or untrusted IP addresses; requests with missing or clearly invalid x-access-token header values that receive 200 OK responses.
• Logs: FUXA access logs showing repeated successful (HTTP 200) responses to /api/project, /api/alarms, or /api/scheduler endpoints from IPs not associated with legitimate operators; absence of valid JWT tokens in requests that still return data.
• Behavioral: Unusual volume of read API calls to project/alarm/scheduler endpoints, particularly in rapid succession suggesting automated enumeration.

The primary remediation is to upgrade FUXA to version 1.3.1 or later, which fixes the authentication bypass in request routing logic and corrects the verifyToken() behavior to properly reject missing or invalid tokens (FUXA Release). As an interim measure, restrict network access to the FUXA web interface using firewall rules or VPN, ensuring only authorized users can reach the API endpoints. There is no documented configuration-only workaround that fully mitigates the issue in version 1.3.0-2773 without upgrading.