CVE-2026-47718— FUXA provides guest and invalid-token access to protected read APIs in secure mode
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-47718
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FUXA provides guest and invalid-token access to protected read APIs in secure mode
Source: CVE Program / CVE List V5
Vulnerability Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| frangoteam | FUXA | = 1.3.0-2773 | - |
II. Public POCs for CVE-2026-47718
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-47718
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-47718 (1)
Other References for CVE-2026-47718 (1)
- 🔗 Release v1.3.1 · frangoteam/FUXA · GitHubx_refsource_MISC
IV. Related Vulnerabilities
Same product: FUXA
- CVE-2026-47717
FUXA's Unauthenticated Project Data Disclosure Exposes Serve - CVE-2026-72586
frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket - CVE-2026-43947
FUXA Vulnerable to Unauthenticated Remote Code Execution via - CVE-2026-43946
FUXA has an unauthenticated arbitrary tag value disclosure v - CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Conf
Same vendor: frangoteam
- CVE-2026-47717
FUXA's Unauthenticated Project Data Disclosure Exposes Serve - CVE-2026-72586
frangoteam FUXA - Missing Authentication on DAQ_QUERY Socket - CVE-2026-43947
FUXA Vulnerable to Unauthenticated Remote Code Execution via - CVE-2026-43946
FUXA has an unauthenticated arbitrary tag value disclosure v - CVE-2026-43945
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Conf
Same weakness: CWE-287
- CVE-2026-73501
kin-openapi: ValidationHandler.Load() Fail-Open Authenticati - CVE-2024-27253
IBM Engineering Requirements Management DOORS Next is impact - CVE-2026-12359
Security vulnerabilities have been found in IBM Verify Ident - CVE-2026-11923
Security vulnerabilities have been found in IBM Verify Ident - CVE-2026-42018
Anonymous user token generation exposure in JFrog Artifactor
V. Comments for CVE-2026-47718
No comments yet