The FUXA web‑based Process Visualization software includes a Socket.IO handler called device‑webapi‑request that, in versions 1.3.2 and earlier, permits any authenticated user who is not an administrator to set a property.address value. When this value points to an arbitrary HTTP or HTTPS URL, the FUXA server performs the outbound request and returns the target’s response body back to the requesting socket. This behavior enables the authenticated user to read data from any reachable internal service or cloud metadata endpoint, potentially exposing sensitive information such as credentials or configuration details. The weakness is a classic Server‑Side Request Forgery (CWE‑918).

The vulnerability affects the FUXA product developed by frangoteam. All releases up to and including version 1.3.2 are impacted, while version 1.3.3 and later contain the fix and are not vulnerable.

The assigned CVSS score of 6.0 reflects a moderate risk; the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated, non‑admin FUXA user, so the attack surface is constrained to those who can log into the web console. The attacker can read internal resources and potentially probe cloud metadata services, but cannot execute code or modify data unless additional access mechanisms are abused. The lack of a publicly documented exploit reduces immediate threat, yet the vulnerability remains exploitable in environments where internal networks are reachable from the authenticated user’s session.