CVE-2026-47720: 
JavaScript vulnerability analysis and mitigation

CVE-2026-47720 is a SQL injection vulnerability in FUXA's TDengine DAQ storage connector that allows unauthenticated remote attackers to read all historical tag data from the connected TDengine database. The flaw exists in the escapeTdString function at server/runtime/storage/tdengine/index.js:10 in the fuxa-server npm package. It affects all versions up to and including 1.3.1 (npm package fuxa-server <= 1.1.14-1243). The vulnerability was discovered by aisafe.io, published on May 29, 2026, and added to the GitHub Advisory Database on June 8, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, FUXA Security Advisory).

The root cause is CWE-89 (SQL Injection): the escapeTdString function doubles single quotes to sanitize input but fails to escape backslashes. Because TDengine's SQL parser interprets \' as a literal single quote within a string, an attacker can craft a tag identifier such as x\' OR 1=1-- to escape the intended string boundary and inject arbitrary SQL clauses. The injected payload is delivered via the sids parameter in a GET /api/daq HTTP request or through the Socket.IO DAQ_QUERY event. No authentication is required because the Socket.IO DAQ_QUERY handler lacks authorization checks and /api/daq accepts guest-level requests even when authentication is enabled (GitHub Advisory, FUXA Security Advisory).

A successful exploit allows an unauthenticated attacker with network access to read the entire contents of the fuxa.meters table in TDengine, which contains the complete historical archive of all PLC tag values recorded by the FUXA instance, along with associated device IDs and device names. The impact is limited to confidentiality — no data modification or denial of service is possible through this vector. In industrial control system (ICS) environments, exposure of historical PLC tag data could reveal operational patterns, process parameters, and device topology, potentially aiding further targeted attacks against OT infrastructure (GitHub Advisory, FUXA Security Advisory).

No public exploit code or active in-the-wild exploitation has been reported as of the advisory date. The EPSS score is approximately 0.069–0.082%, placing it in the 24th percentile for exploitation likelihood within 30 days. The vulnerability is trivially exploitable — it requires no authentication, no user interaction, and low attack complexity, making it accessible to any attacker with network reach to the FUXA instance. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, FUXA Security Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible FUXA instances running version <= 1.3.1 with TDengine configured as the DAQ backend. FUXA typically listens on port 1881 by default.
2. Identify the vulnerable endpoint: Target either the HTTP REST endpoint GET /api/daq with a sids query parameter, or connect via Socket.IO and emit a DAQ_QUERY event — both accept unauthenticated requests.
3. Craft the injection payload: Construct a tag identifier that exploits the backslash bypass, e.g., x\' OR 1=1--. The escapeTdString function will double the single quote to '', but the preceding backslash causes TDengine to interpret \' as a literal quote, breaking out of the string context and appending the injected SQL clause.
4. Send the malicious request: Issue a request such as GET /api/daq?sids=x%5C%27%20OR%201%3D1-- (URL-encoded) to the FUXA server.
5. Retrieve data: The manipulated SQL query executes against TDengine and returns all rows from fuxa.meters, exposing the complete historical tag-value archive including PLC tag names, values, device IDs, and device names (GitHub Advisory, FUXA Security Advisory).

• Network: Unexpected or anomalous GET /api/daq requests with sids parameter values containing backslashes (\), single quotes ('), SQL keywords (OR, AND, UNION, SELECT), or comment sequences (--, #).
• Network: Unusual Socket.IO DAQ_QUERY events from unknown or external IP addresses, particularly with malformed or oversized tag identifier payloads.
• Logs: FUXA server access logs showing requests to /api/daq from IPs not associated with known clients, especially with URL-encoded special characters (%5C, %27, %20OR%20) in query strings.
• Logs: TDengine query logs (if enabled) showing unexpectedly broad SELECT queries against fuxa.meters returning large result sets, or queries with injected OR 1=1 clauses.
• Process/Application: Abnormally large response payloads from /api/daq endpoints that would not correspond to a legitimate single-tag query.

The fix is available in FUXA version 1.3.2, which improves input escaping in the TDengine connector to properly handle backslashes in addition to single quotes. Users should upgrade to FUXA >= 1.3.2 immediately. As a temporary workaround where upgrading is not immediately possible, restrict network access to the FUXA instance using firewall rules or network segmentation to limit exposure to trusted hosts only, and avoid exposing FUXA directly to the internet. Note that enabling FUXA's built-in authentication does not mitigate this vulnerability, as the affected endpoints bypass authorization checks (GitHub Advisory, FUXA Security Advisory).

The vulnerability was discovered and reported by aisafe.io, with the reporter credited as aisafe-bot and the advisory reporter as adrgs. The advisory was published by the FUXA maintainer (unocelli) on May 29, 2026, and formally added to the GitHub Advisory Database on June 8, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time (FUXA Security Advisory).