As reported by CISA in advisory ICSA-26-181-02, a high-severity authentication bypass vulnerability has been disclosed in Frangoteam's FUXA SCADA/HMI platform — a widely-deployed open-source supervisory control and data acquisition interface used across operational technology (OT) environments globally.
Vulnerability At a Glance
- CVE
- CVE-2026-13207
- CVSS v3 Score
- 7.5 — High
- Affected Versions
- Frangoteam FUXA SCADA/HMI ≤ 1.3.1
- Vulnerability Type
- Authentication Bypass via Dot-Segment Path Normalization (CWE-287)
- Attack Vector
- Network — unauthenticated, remote exploitation
- Patch Available
- Operators should consult the CISA advisory and the Frangoteam GitHub repository for the latest release
- Exploitation in the Wild
- Not confirmed at time of publication
- Sectors at Risk
- Critical Manufacturing, Energy, Water and Wastewater — worldwide deployments
Why This Vulnerability Is More Dangerous Than It Appears
A CVSS score of 7.5 might suggest a serious-but-manageable risk in an enterprise IT context. In an OT/ICS environment, however, the calculus changes dramatically. FUXA is frequently deployed in environments where internet-accessible HMI panels are — regrettably — not uncommon, and where the operator base includes small utilities and manufacturers without dedicated security staff.
The root cause here is a classic but pernicious mistake: the REST API's authentication middleware evaluates paths before normalization. This means that dot-segment sequences like /api/./users or /api/./roles are not recognized as protected endpoints by the auth layer, even though the underlying router resolves them correctly to their protected equivalents. The result is a complete bypass of access controls — no credentials required.
The practical impact isn't just embarrassing — it's operationally dangerous. Full enumeration of user accounts and role assignments in a SCADA/HMI system gives adversaries a precise map of who has operator-level, engineer-level, or administrator-level access. This is reconnaissance gold for a targeted ICS attack, credential stuffing campaign, or social engineering operation.
In environments with weak credential hygiene — a pervasive issue in OT — an attacker who knows the usernames can pivot rapidly to brute-force or password spraying attacks. And because FUXA is open-source and its API structure is publicly documented, the bar to crafting an exploit is extremely low. We should assume proof-of-concept code will surface quickly if it hasn't already.
Who Is Most Exposed
The deployments most at risk share a common profile:
Shield53 Recommendations: Immediate Actions
Patch
- Update FUXA to a version released after the patch commit that addresses path normalization in the API router. Verify the fix is present before returning the system to operation.
- Monitor the Frangoteam GitHub repository for the official patched release and review the commit diff to confirm the normalization fix.
If Patching Is Delayed
- Restrict network access to the FUXA web interface immediately. FUXA should never be directly internet-accessible. Place it behind a VPN or jump host.
- Implement an application-layer WAF rule or reverse proxy rewrite rule to block or reject requests containing dot-segment sequences (
/./) in API paths. - Enable network-level logging on the FUXA host to detect anomalous API calls targeting
/api/./users,/api/./roles, or similar patterns — treat any occurrence as a confirmed intrusion indicator.
Broader Hardening
- Audit all user accounts and role assignments within FUXA immediately. If this vulnerability was exploited prior to patching, assume account enumeration has already occurred.
- Enforce strong, unique passwords across all FUXA accounts and rotate credentials as a precautionary measure.
- Review OT/IT segmentation controls. SCADA/HMI systems should sit in an isolated network zone with strict allow-list firewall rules.
- Subscribe to CISA ICS advisories to ensure your team receives future disclosures for all deployed OT software.
The transparency from CISA in publishing this advisory is valuable — but awareness must translate into action. In critical infrastructure environments, a high-severity unauthenticated API flaw is not a "schedule for next patch cycle" issue. It is a drop-everything-now event.
