CVE-2026-47717
validatedZero produced an exploit or a check.GHSA-q3w6-q3hc-c5x6 ↗EUVD-2026-57690 ↗
description
FUXA fuxa-server 1.3.0 can disclose sensitive project configuration through its project API. A remote attacker can obtain configuration such as scripts, device information, HMI settings, and alarm definitions when the affected service is reachable, including when secure mode is enabled.
mitigation
Upgrade FUXA/fuxa-server to version 1.3.1. Until upgraded, restrict network access to the FUXA service to trusted administrators and networks.
fixed in >= 1.3.1
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-08-12 22:18Zcve.org record for CVE-2026-47717
- 2026-11-06vulncheck_kev: trigger signal, started the run
- 2026-11-06 00:00Z
- 2026-11-06 05:09Znuclei-templates ships a detection
this entry in the feed
GET /api/v1/feed/CVE-2026-47717
{ "etk_id": "ETK-2026-3695", "cve_id": "CVE-2026-47717", "display_id": "CVE-2026-47717", "ghsa_id": "GHSA-q3w6-q3hc-c5x6", "euvd_id": "EUVD-2026-57690", "status": "published", "anchor_state": "anchored", "title": "Unauthenticated project-data exposure in FUXA", "summary": "FUXA fuxa-server 1.3.0 can disclose sensitive project configuration through its project API. A remote attacker can obtain configuration such as scripts, device information, HMI settings, and alarm definitions when the affected service is reachable, including when secure mode is enabled.", "mitigation": "Upgrade FUXA/fuxa-server to version 1.3.1. Until upgraded, restrict network access to the FUXA service to trusted administrators and networks.", "vendor": "frangoteam", "product": "fuxa", "affected": [ { "affected_notes": [], "affected_ranges": [ "1.3.0" ], "ecosystem": "npm", "fixed_versions": [ ">= 1.3.1" ], "package_name": "fuxa-server", "purl": "pkg:npm/fuxa-server" } ], "cwes": null, "cvss_score": 7.5, "cvss_src": "other", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.0027696833333333334, "t0_at": "2026-08-12T22:18:04.321000+00:00", "signals": { "check": { "at": "2026-11-06T05:09:46.097225+00:00", "days": 85.28590018778935, "is_lower_bound": false, "measured_at": "2026-08-12T22:18:04.321000+00:00", "url": null }, "kev": { "at": "2026-11-06T00:00:00+00:00", "days": 86, "is_lower_bound": false, "measured_at": "2026-08-12T22:18:04.321000+00:00", "precision": "day", "url": "https://vulncheck.com/cve/CVE-2026-47717" }, "public_poc": { "at": "2026-11-06T05:09:46.110336+00:00", "days": 85.28590033953704, "is_lower_bound": false, "measured_at": "2026-08-12T22:18:04.321000+00:00", "url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-47717.yaml" }, "trigger_signal": { "at": "2026-11-06T00:00:00+00:00", "days": 85.07078332175927, "is_lower_bound": false, "measured_at": "2026-08-12T22:18:04.321000+00:00", "url": "https://vulncheck.com/cve/CVE-2026-47717" } } }
published 2026-11-06 05:09Z
last change 2026-11-06 08:12Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.