Unprotected Socket.IO event handlers in FUXA allow an unauthenticated or guest user to retrieve device‑discovery, node‑attribute, host‑network‑interface, and device‑tag metadata when secureEnabled is true. This results in the disclosure of internal system information that is not intended for public HMI viewing. The weakness is an access control error identified by CWE‑862.

The vulnerability affects frangoteam FUXA versions 1.3.2 and earlier. The affected components are the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers located in server/runtime/index.js.

The CVSS v3 score of 6.9 indicates moderate severity. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog. A remote unauthenticated or guest user can invoke the vulnerable Socket.IO events without prior authorization, making exploitation straightforward given that the services are exposed over a network. The primary risk is the acquisition of unsolicited system discovery information rather than direct control or damage to the target.