CVE-2026-47720

{
  "id": "CVE-2026-47720",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-18T20:17:15.250",
  "lastModified": "2026-11-09T20:10:00.200",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2."
    },
    {
      "lang": "es",
      "value": "FUXA es un software de visualización de procesos basado en web (SCADA/HMI/Dashboard). Antes de la versión 1.3.2, la función escapeTdString del conector de almacenamiento TDengine DAQ en server/runtime/storage/tdengine/index.js duplica las comillas simples pero no escapa las barras invertidas. Un atacante remoto no autenticado puede enviar un identificador de etiqueta sids manipulado a través de GET /api/daq o el evento Socket.IO DAQ_QUERY para que TDengine interprete la secuencia de barra invertida y comilla como sintaxis SQL. La consulta inyectada puede devolver cada fila de fuxa.meters, exponiendo valores históricos de etiquetas PLC, identificadores de dispositivos y nombres de dispositivos incluso cuando la autenticación de FUXA está habilitada. Este problema está solucionado en la versión 1.3.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "frangoteam",
          "product": "FUXA",
          "versions": [
            {
              "version": "< 1.3.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 1.4
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-19T13:10:48.542563Z",
          "id": "CVE-2026-47720",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/frangoteam/FUXA/commit/b78f6159d02a56ce5ff48207feb936afb3534fc8",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/frangoteam/FUXA/pull/2343",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.2",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-h9fj-c2qr-76g2",
      "source": "[email protected]"
    }
  ]
}