A missing authentication check in the frangoteam/FUXA code allows an unauthenticated attacker to trigger the DAQ_QUERY event via Socket.IO and retrieve every stored sensor reading. When secureEnabled is enabled, other sensitive Socket.IO operations validate the connection token, but the DAQ_QUERY handler in server/runtime/index.js does not perform this check. The result is that anyone with network access to the Socket.IO endpoint can exfiltrate historical sensor data without authentication, constituting a confidentiality breach.

The flaw affects frangoteam's FUXA platform up to version 1.3.3. No information is provided about mitigated releases beyond 1.3.3, so all installations newer than that statement may still be exposed unless the vendor publishes an update.

The overall CVSS score is 7.5, indicating a high impact attack. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog. The most likely attack vector is remote via the Socket.IO interface; a threat actor only needs network connectivity to the FUXA WebSocket endpoint to trigger the unauthenticated DAQ_QUERY event. Once accessed, the attacker can exfiltrate any historical sensor data without needing initial authentication.