CVE-2026-47720

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47720", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-19T21:29:25.482Z", "datePublished": "2026-08-18T19:58:26.111Z", "dateUpdated": "2026-08-19T13:10:57.660Z"}, "containers": {"cna": {"title": "FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-h9fj-c2qr-76g2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-h9fj-c2qr-76g2"}, {"name": "https://github.com/frangoteam/FUXA/pull/2343", "tags": ["x_refsource_MISC"], "url": "https://github.com/frangoteam/FUXA/pull/2343"}, {"name": "https://github.com/frangoteam/FUXA/commit/b78f6159d02a56ce5ff48207feb936afb3534fc8", "tags": ["x_refsource_MISC"], "url": "https://github.com/frangoteam/FUXA/commit/b78f6159d02a56ce5ff48207feb936afb3534fc8"}, {"name": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.2"}], "affected": [{"vendor": "frangoteam", "product": "FUXA", "versions": [{"version": "< 1.3.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T19:58:26.111Z"}, "descriptions": [{"lang": "en", "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2."}], "source": {"advisory": "GHSA-h9fj-c2qr-76g2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-19T13:10:48.542563Z", "id": "CVE-2026-47720", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T13:10:57.660Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-19T13:10:48.542563Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-19T13:10:54.486Z"}}], "cna": {"title": "FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString", "source": {"advisory": "GHSA-h9fj-c2qr-76g2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "frangoteam", "product": "FUXA", "versions": [{"status": "affected", "version": "< 1.3.2"}]}], "references": [{"url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-h9fj-c2qr-76g2", "name": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-h9fj-c2qr-76g2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/frangoteam/FUXA/pull/2343", "name": "https://github.com/frangoteam/FUXA/pull/2343", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/frangoteam/FUXA/commit/b78f6159d02a56ce5ff48207feb936afb3534fc8", "name": "https://github.com/frangoteam/FUXA/commit/b78f6159d02a56ce5ff48207feb936afb3534fc8", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.2", "name": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-18T19:58:26.111Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47720", "state": "PUBLISHED", "dateUpdated": "2026-08-19T13:10:57.660Z", "dateReserved": "2026-05-19T21:29:25.482Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-18T19:58:26.111Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FUXA", "vendor": "frangoteam", "versions": [{"status": "affected", "version": "< 1.3.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a crafted sids tag identifier through GET /api/daq or the Socket.IO DAQ_QUERY event so TDengine interprets the backslash and quote sequence as SQL syntax. The injected query can return every row from fuxa.meters, exposing historical PLC tag values, device identifiers, and device names even when FUXA authentication is enabled. This issue is fixed in version 1.3.2."}, {"lang": "es", "value": "FUXA es un software de visualizaci\u00f3n de procesos basado en web (SCADA/HMI/Dashboard). Antes de la versi\u00f3n 1.3.2, la funci\u00f3n escapeTdString del conector de almacenamiento TDengine DAQ en server/runtime/storage/tdengine/index.js duplica las comillas simples pero no escapa las barras invertidas. Un atacante remoto no autenticado puede enviar un identificador de etiqueta sids manipulado a trav\u00e9s de GET /api/daq o el evento Socket.IO DAQ_QUERY para que TDengine interprete la secuencia de barra invertida y comilla como sintaxis SQL. La consulta inyectada puede devolver cada fila de fuxa.meters, exponiendo valores hist\u00f3ricos de etiquetas PLC, identificadores de dispositivos y nombres de dispositivos incluso cuando la autenticaci\u00f3n de FUXA est\u00e1 habilitada. Este problema est\u00e1 solucionado en la versi\u00f3n 1.3.2."}], "id": "CVE-2026-47720", "lastModified": "2026-11-09T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47720", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-19T13:10:48.542563Z", "version": "2.0.3"}}]}, "published": "2026-08-18T20:17:15.250", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/frangoteam/FUXA/commit/b78f6159d02a56ce5ff48207feb936afb3534fc8"}, {"source": "security-advisories@github.com", "url": "https://github.com/frangoteam/FUXA/pull/2343"}, {"source": "security-advisories@github.com", "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-h9fj-c2qr-76g2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.3.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "FUXA", "source": "cna", "vendor": "frangoteam"}, "product": "fuxa", "vendor": "frangoteam"}], "created": "2026-08-18T21:45:16.789064+00:00", "updated": "2026-08-18T21:45:16.893021+00:00", "vendors": ["frangoteam", "frangoteam$PRODUCT$fuxa"]}