The vulnerability is an authorization bypass that enables an unauthenticated, remote attacker to send WebSocket messages to write or disable device tags in FUXA, thereby bypassing role‑based access controls and exposing connected SCADA/ICS environments to follow‑on actions.

Affected software is FUXA by frangoteam. Versions through 1.2.9 are vulnerable; the issue was patched in version 1.2.10.

The CVSS score of 9.3 indicates critical severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog, so no known widespread exploitation exists. Attackers can exploit the WebSocket endpoint while unauthenticated, sending crafted messages to overwrite tags or disable drivers. If a vulnerable FUXA instance is exposed to untrusted networks, the vulnerability poses a high risk to control systems.