FUXA SCADA auth bypass exposes user data
An authentication bypass via dot-segment path normalization in Frangoteam FUXA SCADA/HMI ≤1.3.1 allows unauthenticated attackers to enumerate all user accounts and roles.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA has issued an advisory for CVE-2026-13207, an authentication bypass vulnerability in Frangoteam FUXA SCADA/HMI versions 1.3.1 and prior. The flaw stems from improper handling of dot-segment path normalization in the REST API router, which fails to normalize sequences before applying authentication middleware. Attackers can exploit this by prefixing API paths with dot-segments such as /api/./users, /api/./roles, or /api/project/../users to bypass authentication checks and access protected endpoints without credentials.
The vulnerability allows unauthenticated remote attackers to enumerate all user accounts and role assignments on affected FUXA instances, exposing sensitive user and role data. FUXA is deployed worldwide across critical manufacturing, energy, and water/wastewater sectors. Frangoteam has released version 1.3.2 to address the vulnerability, and users are urged to upgrade immediately.
CISA recommends minimizing network exposure for affected systems, ensuring they are not internet-accessible, and placing them behind firewalls isolated from business networks. No public exploitation has been reported to CISA at this time, though the vulnerability's technical details are now public.
Mentioned in this report
Detection guidance
FUXA REST API Auth Bypass via Dot-Segment Path Traversal
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects HTTP requests to FUXA REST API endpoints containing dot-segment sequences (e.g. /api/./users, /api/project/../roles) used to bypass authentication middleware (CVE-2026-13207). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: FUXA REST API Auth Bypass via Dot-Segment Path Traversal
id: 8c8de23f-6f2b-5854-a07f-5867bffc9214
status: experimental
description: 'Detects HTTP requests to FUXA SCADA/HMI REST API endpoints that include
dot-segment
sequences (./ or ../) within the path, which can bypass authentication middleware
due to improper path normalization (CVE-2026-13207). Attackers use paths such as
/api/./users, /api/./roles, or /api/project/../users to access protected endpoints
without credentials.
'
references:
- https://www.cisa.gov/
author: Vorant
tags:
- attack.t1190
logsource:
category: webserver
detection:
selection_api_path:
cs-uri-stem|contains: /api/
selection_dotseg:
cs-uri-stem|re: \/api\/(\.{1,2}\/)|\/api\/[^\/]+\/\.\.\/
filter_static:
cs-uri-stem|contains:
- /api/./static
- /api/./assets
condition: selection_api_path and selection_dotseg and not filter_static
falsepositives:
- Legitimate relative-path requests generated by misconfigured reverse proxies or
load balancers
- Automated vulnerability scanners testing path normalization (expected during authorized
pentests)
level: high
Unauthenticated Access to FUXA User/Role Enumeration Endpoints
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects successful HTTP responses (200 OK) to FUXA /api/users or /api/roles endpoints without an accompanying authenticated session, indicating potential exploitation of the auth bypass to enumerate accounts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Access to FUXA User or Role Enumeration Endpoints
id: a264d149-ff33-5337-8e0f-972a0fe74c45
status: experimental
description: 'Detects HTTP requests reaching FUXA''s /api/users or /api/roles endpoints
that
succeed (HTTP 200) without a valid session/authorization header being logged,
consistent with post-exploitation enumeration of accounts after bypassing
authentication via dot-segment path normalization (CVE-2026-13207).
'
references:
- https://www.cisa.gov/
author: Vorant
tags:
- attack.t1078
- attack.t1190
logsource:
category: webserver
detection:
selection_endpoint:
cs-uri-stem|contains:
- /api/users
- /api/roles
selection_success:
sc-status: 200
filter_authorized:
cs-cookie|contains: session=
condition: selection_endpoint and selection_success and not filter_authorized
falsepositives:
- Legitimate administrative access to user/role management pages with cookies stripped
from logs
- Internal monitoring or health-check scripts polling the API without session cookies
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-181-02
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs