FUXA Authorization Bypass Vulnerability Allowing Unauthenticated Scheduler Manipulation

An authorization bypass vulnerability has been identified in FUXA, a web-based process visualization software, versions 1.2.8 prior to 1.2.11. This vulnerability allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, potentially disrupting connected ICS/SCADA environments. The issue has been addressed in version 1.2.11.

Impact

Exploitation of this vulnerability allows an unauthenticated remote attacker to gain guest authentication status and manipulate schedulers. This includes creating, modifying, or deleting schedules that can trigger immediate or cyclical actions on connected devices, such as forcing them into specific states or executing existing scripts on the server.

Remediation

Users are advised to update to FUXA version 1.2.11 or later.