FUXA Authorization Bypass Vulnerability Allowing Unauthenticated Remote Tag Modification

An authorization bypass vulnerability has been identified in FUXA, a web-based process visualization software. This vulnerability allows unauthenticated, remote attackers to modify device tags through WebSockets. It affects FUXA versions prior to 1.2.9. The exploitation of this vulnerability enables attackers to bypass role-based access controls, overwrite arbitrary device tags, or disable communication drivers. This exposure could lead to manipulation of physical processes and disconnection of devices from the HMI in ICS/SCADA environments.

Impact

Exploitation of this vulnerability allows for unauthorized modification of device tags, which could disrupt communication with connected devices and manipulate physical processes through the HMI.

Remediation

Users are advised to update to FUXA version 1.2.10, where this vulnerability has been patched.