An unauthenticated attacker can exploit the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in FUXA to send arbitrary HTTP or HTTPS requests, or initiate OPC UA or ODBC connections from the server host. The response is returned through the same Socket.IO event, effectively providing a read‑only Server Side Request Forgery oracle. The weakness is classified as CWE‑918. This allows disclosure of internal web services, cloud metadata, proprietary databases, and other resources reachable from the host, potentially enabling further exploitation of those systems.

The vulnerability affects all installations of frangoteam:FUXA prior to version 1.3.2. In particular, any FUXA instance running the affected codebase exposes the Socket.IO handlers without checking if the socket is authorized, allowing attackers to specify arbitrary target addresses via the property.address or endpoint fields.

The CVSS score for this issue is 8.2, indicating a high severity. EPSS information is not available, and the vulnerability is not listed in the CISA KEV catalog. An attacker requires only unauthenticated access to the FUXA instance and the ability to send Socket.IO messages to trigger the vulnerable handlers. Because the server can reach internal and external targets regardless of the secureEnabled flag, the risk of data exposure is significant even in HTTPS‑only deployments.