Frangoteam FUXA SCADA/HMI

Key Points:

• CVE-2026-13207 is a critical authentication bypass vulnerability in Frangoteam FUXA SCADA/HMI versions 1.3.1 and prior, allowing unauthenticated remote attackers to enumerate user accounts and role assignments.
• The vulnerability affects critical infrastructure sectors including manufacturing, energy, and water management, with potential exposure for systems deployed worldwide.
• Organizations are advised to minimize network exposure for control systems, utilize firewalls, and implement secure remote access methods like VPNs.

Technical Details: The vulnerability arises from improper handling of dot-segment path normalization in the REST API, enabling attackers to access protected endpoints without authentication by manipulating request paths.

MITRE ATT&CK Techniques: None mentioned

IOCs Mentioned: None mentioned