CyberRota Analysis
AI-GeneratedA missing authentication vulnerability in frangoteam/FUXA versions up to 1.3.3 allows unauthenticated remote attackers to access all historical sensor data through the DAQ_QUERY Socket.IO event. This oversight poses a significant risk, as it exposes sensitive information without proper authorization checks. Organizations using this software should prioritize remediation to protect against potential data breaches and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A missing authentication vulnerability in frangoteam/FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.