The vulnerability, identified by **Joshua Hayes** of **Cited Relevance LLC** and reported to **CISA**, lies within the REST API of **FUXA SCADA/HMI**. It stems from a failure in the API router to properly normalize dot-segment sequences before enforcing authentication middleware. ### The Vulnerability Explained Attackers can exploit this flaw by prefixing protected API paths with dot-segments, such as `/api/./users` or `/api/project/../users`. This technique bypasses authentication checks, granting unauthorized access to sensitive user and role data without requiring any credentials. The **CVSS v3** score for this vulnerability is 7.5, indicating a high severity. ### Affected Systems and Sectors **Frangoteam FUXA SCADA/HMI** is widely deployed across critical infrastructure sectors, including Critical Manufacturing, Energy, and Water and Wastewater. The software's presence in these vital industries amplifies the potential impact of this vulnerability, making it a priority for immediate remediation. ### Recommended Mitigations **CISA** urges organizations to take immediate defensive measures to minimize the risk of exploitation. Key recommendations include: * **Minimize Network Exposure**: Ensure all control system devices and systems are not directly accessible from the internet. * **Network Segmentation**: Place control system networks and remote devices behind firewalls, isolating them from business networks. * **Secure Remote Access**: When remote access is necessary, utilize robust methods like Virtual Private Networks (**VPNs**), ensuring they are updated to the latest versions. It's crucial to remember that a VPN's security is contingent on the security of its connected devices. * **Defense-in-Depth Strategies**: Implement comprehensive cybersecurity strategies, as detailed in **CISA**'s publications like 'Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies'. Organizations are also advised to perform thorough impact analyses and risk assessments before deploying any defensive measures. While no public exploitation specifically targeting **CVE-2026-13207** has been reported to **CISA** at this time, the potential for unauthorized access to critical system information necessitates prompt action. ### Proactive Security Posture Beyond technical mitigations, **CISA** emphasizes the importance of protecting against social engineering attacks. Users should exercise caution with unsolicited email messages, avoiding suspicious web links and attachments. Resources such as 'Recognizing and Avoiding Email Scams' and 'Avoiding Social Engineering and Phishing Attacks' provide further guidance.