Fuxa: 694 Fingerprints on a Browser-Based HMI, and 3,795 Titles That Overstate It

Industrial interfaces used to live on a panel in a control room. Then they moved to the browser, because the browser is everywhere and a web HMI is cheaper to deploy than a dedicated terminal. Fuxa is an open-source SCADA and HMI project built on that premise, and the premise is exactly why its exposure deserves attention.

What the queries returned

Measured through ZoomEye on 2026-10-23, page size one, all sub-types:

• app="Fuxa" returned 694.
• title="Fuxa" returned 3,795.

Search link: https://www.zoomeye.ai/searchResult?q=YXBwPSJGdXhhIg%3D%3D

The fivefold gap is the same pattern seen with Docassemble, and it has the same cause. The product name appears in titles on documentation sites, tutorials, project galleries and translated pages, none of which are the application. The fingerprint count is the more useful figure, and at just under seven hundred it is small enough to describe as a specific population rather than a population of abstract scale.

Small is not the same as unimportant. The count is a count of hosts, and each host is a connection to physical equipment.

Why an industrial HMI is a different category

An exposed dashboard usually leaks information. An exposed HMI can also change something in the physical world, because writing to a register is part of what it is for. Fuxa supports connections to PLC protocols including Modbus, Siemens S7 and OPC UA, and a dashboard view built over those connections typically permits writes as well as reads. The operator who can see a tank level from a browser is often the same operator who can command the valve.

That capability reshapes the risk model in three ways:

• Availability becomes the primary concern. A stopped production line is a business event with a cost per hour, and it does not require the attacker to understand the process deeply.
• Safety is not a software property. Any change that reaches a physical process has consequences the software cannot assess.
• The control network was not designed for this. Historically, the HMI sat on a segmented network with no route to the internet. A browser HMI invites the opposite arrangement.

What an operator usually got wrong

The failure mode is rarely a sophisticated exploit. It is a deployment decision:

• The HMI was published so a manager could glance at a dashboard from home, and the route was never reviewed.
• Default credentials were retained because the commissioning engineer set them and never handed them over.
• The web interface was placed in front of a PLC network without a proxy, which makes the browser the outer boundary.
• A protocol gateway was added to bridge a legacy device and left with the vendor's demonstration configuration.

None of those require an attacker with industrial knowledge, which is the uncomfortable part. The reconnaissance is a search engine query, and the entry is a login page.

Assessing the population honestly

The measured instances are a mixture. Some are demonstrations in engineering courses, which is plausible given how many students build a Fuxa dashboard as an exercise. Some are lab rigs. Some are surely production lines, though this measurement cannot say how many. Reporting 694 as "exposed industrial systems" would be a claim the data does not support, and reporting zero risk because the number is small would be the opposite error. The defensible statement is that a few hundred hosts are answering as this software on the public internet, and any of them that connect to real equipment represents a physical consequence.

Controls that hold

• Treat the HMI as part of the control network, not as part of the web estate, and place it behind a remote-access broker rather than a port forward.
• Require per-user accounts with recorded roles and remove vendor defaults before commissioning is signed off.
• Restrict the dashboard's write capability at the protocol layer where the PLC supports it, so a compromised session cannot issue commands.
• Log every value write with the operator identity, and review those logs when nothing else explains a process anomaly.

Limitations

ZoomEye figures describe observed hosts and will vary with crawl window and fingerprint coverage. A fingerprint hit confirms the application answered, not that it controls equipment, not that default credentials are valid, and not that any given write path is enabled. The title count includes many sites that merely discuss the software.

References

• ZoomEye application fingerprint query for Fuxa, run 2026-10-23, total 694.
• ZoomEye title query for Fuxa, run 2026-10-23, total 3,795.
• Fuxa project documentation covering PLC connection types, dashboard write access and authentication.