# FUXA SCADA Authentication Bypass Exposes User Accounts on Industrial Control Systems Worldwide


## The Threat


Frangoteam's FUXA SCADA/HMI (Human-Machine Interface) platform contains a critical authentication bypass vulnerability that allows unauthenticated attackers to directly enumerate all user accounts and role assignments on a target system. The vulnerability, tracked as CVE-2026-13207, exploits a flaw in the REST API's request routing layer where dot-segment path normalization is applied *after* authentication middleware is evaluated, rather than before. This sequencing failure creates a window for attackers to craft specially-formatted HTTP requests that bypass security checks entirely.


The attack is remarkably simple: an attacker can prefix legitimate API paths with dot-segments (e.g., /api/./users instead of /api/users, or /api/project/../users), and the authentication middleware fails to recognize these as equivalent to the protected endpoints. The unauthenticated request passes through without credentials, reaches the API handler, and returns sensitive data—user names, email addresses, role assignments, and permission configurations—that should never be exposed to anonymous users.


FUXA is deployed globally across water systems, energy grids, manufacturing plants, and other critical infrastructure. The SCADA/HMI software is trusted to manage real-time control of physically critical assets. Exposure of user account details and role mappings represents both a direct reconnaissance step for follow-up attacks and a compliance violation in regulated environments. An attacker with this information can identify high-privilege accounts, social-engineer operators, or craft targeted exploitation attempts against other vulnerabilities in the system.


## Severity and Impact


| Metric | Value |

|--------|-------|

| CVE ID | CVE-2026-13207 |

| Affected Versions | FUXA SCADA/HMI ≤ 1.3.1 |

| CVSS v3.1 Score | 7.5 (HIGH) |

| CVSS v4.0 Score | 8.7 (HIGH) |

| Vector String (v3.1) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |

| Vector String (v4.0) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |

| Attack Complexity | Low (no special techniques required; trivial to exploit) |

| Authentication Required | None (unauthenticated attacker) |

| User Interaction | None |

| CWE | CWE-290 (Authentication Bypass by Spoofing) |


The impact is restricted to confidentiality—an attacker gains read-only access to user and role metadata. Integrity and availability of the control system itself are not directly affected by this vulnerability. However, the intelligence gathered (user enumeration) is a critical first step in multi-stage attacks, including credential attacks against identified accounts, privilege escalation, or lateral movement into the broader industrial network.


## Affected Products


Frangoteam FUXA SCADA/HMI

  • Versions 1.3.1 and earlier
  • Installation method: Self-hosted open-source deployment (GitHub releases)
  • Deployment scope: On-premises critical infrastructure globally

    • Organizations running FUXA versions 1.3.0, 1.3.1, or any earlier release should treat this as an immediate concern.


    ## Mitigations


    Primary Remediation:

  • Upgrade immediately to FUXA version 1.3.2 or later. Frangoteam has released a patched version available at https://github.com/frangoteam/FUXA/releases that properly normalizes dot-segments *before* applying authentication middleware.

    • Interim Mitigations (while planning upgrades):

  • Network segmentation: Ensure FUXA instances are not exposed to the internet or untrusted networks. Place HMI systems behind firewall rules that restrict access to authorized operations networks only.
  • Access control: Deploy a reverse proxy (nginx, HAProxy) in front of FUXA with request filtering rules that reject paths containing dot-segments (/. or /.. sequences). This can provide temporary protection while patches are staged.
  • Monitoring: Enable detailed access logging on the API layer and monitor for requests containing dot-segment sequences or unusual path structures. Alert on any unauthenticated access attempts to /api/users or /api/roles endpoints.
  • VPN requirement: For any remote access scenarios, require authenticated VPN access to the FUXA network before allowing HMI connections.

    • Recommended Best Practices:

  • CISA recommends minimizing network exposure for all control system devices by placing them behind firewalls and isolating them from business networks.
  • When remote access is required, use secure methods such as VPNs (keeping VPN software fully patched).
  • Perform a full impact analysis before deploying any changes in operational environments; coordinate with process engineers to schedule maintenance windows safely.
  • Implement Defense-in-Depth strategies as detailed in CISA's "Improving Industrial Control Systems Cybersecurity" guidance.

    • ## References


  • CISA Advisory: https://www.cisa.gov/news-events/alerts/2026 (official U.S. government alert)
  • GitHub Repository & Releases: https://github.com/frangoteam/FUXA/releases (upstream patches and version history)
  • CVE Details: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-13207
  • CWE-290: https://cwe.mitre.org/data/definitions/290.html (Authentication Bypass by Spoofing)
  • CISA ICS Cybersecurity Guidance: https://www.cisa.gov/ics

    • ---


    ## HackWire Analysis


    Path normalization bypasses are among the most dangerous authentication flaws in industrial control systems because they're trivial to exploit and often overlooked in security reviews. The attack requires no authentication, no sophisticated tooling, and no knowledge of system internals—just a modified URL. This particular instance reveals a broader architectural pattern: the placement of authentication middleware *after* request routing, rather than at the gateway layer, assumes that routing itself is secure. It almost never is.


    What's especially concerning about CVE-2026-13207 is that FUXA is open-source software. The vulnerability was exposed to thousands of potential researchers and threat actors simultaneously upon public disclosure. Organizations that don't monitor GitHub releases or security advisories closely could remain vulnerable for weeks or months without knowing. Unlike commercial SCADA platforms where security patches flow through established vendor channels, open-source critical infrastructure software relies on volunteer vigilance and self-service patching—creating longer tail times between fix availability and deployment.


    The metadata exposure (user enumeration + role mapping) is the reconnaissance phase of larger attacks. An attacker who identifies the admin account or discovers a high-privilege role assignment for a contractor account gains targeting direction for social engineering, credential spraying, or exploitation of secondary vulnerabilities. In water utilities or energy sectors especially, this data is gold for attackers preparing focused campaigns.


    Organizations should treat this as a staging issue: upgrade to 1.3.2 immediately, but also review whether other open-source critical infrastructure software in your environment follows the same vulnerable pattern (authentication checked after routing, not before). This flaw is common enough that finding similar issues in other systems is realistic. — *HackWire Editorial*


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)