The TDengine DAQ connector in FUXA fails to escape backslashes in user input, allowing a crafted request to inject arbitrary SQL when the server processes the sids tag identifier. An attacker can send a GET request to /api/daq or use the Socket.IO DAQ_QUERY event without authentication, causing TDengine to interpret a backslash‑quote sequence as SQL syntax. The resulting query reads all rows from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. The flaw is a classic SQL injection (CWE‑89) that leads to information disclosure.

FUXA by FrangoTeam is impacted. Any version prior to 1.3.2 contains the vulnerability; versions 1.3.2 and later have the fix applied.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA KEV. The attack can be performed remotely by an unauthenticated user through standard HTTP GET or Socket.IO requests, so the exploitability is relatively high for exposed services. If the /api/daq endpoint or DAQ_QUERY event is reachable from untrusted networks, an attacker can easily gain the disclosed data, resulting in a breach of confidentiality for the PLC and device information.