FUXA is a web‑based process visualization platform that, via a flaw in its configuration handling, allows an unauthenticated remote attacker to retrieve the full InfluxDB administrative database credentials. The vulnerability is a classic failure of authentication and storage of sensitive information, identified as CWE‑306 (Missing Authentication) and CWE‑312 (Cleartext Storage of Sensitive Information). Possession of the credentials lets the attacker authenticate directly to the database, enabling full read, modify, or delete capabilities over all historical process data, as well as the potential to corrupt the database and cause denial of service.

The affected product is FUXA supplied by frangoteam, versions up to and including 1.2.9. The issue was addressed in version 1.2.10.

The CVSS score of 9.1 marks this vulnerability as critical. The EPSS score is below 1%, indicating a very low exploitation probability at the time of analysis, and it is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, unauthenticated access through the web interface, exploiting the exposed configuration endpoint.