Frangoteam Fuxa vulnerabilities

CVE-2023-33831 [CRITICAL] CWE-77 CVE-2023-33831: A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.

CVE-2025-69985 [CRITICAL] CWE-288 CVE-2025-69985: FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Executio FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE). The vulnerability exists in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP "Referer" header to validate internal requests. A remote unauthenticated attacker can bypass JWT authentication by spoofing the Referer he

CVE-2026-25895 [CRITICAL] CWE-22 CVE-2026-25895: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerabi FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. A path traversal vulnerability in FUXA allows an unauthenticated, remote attacker to write arbitrary files to arbitrary locations on the server filesystem. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

CVE-2026-25939 [CRITICAL] CWE-862 CVE-2026-25939: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through version 1.2.10, an authorization bypass vulnerability in the FUXA allows an unauthenticated, remote attacker to create and modify arbitrary schedulers, exposing connected ICS/SCADA environments to follow-on actions. This has been patched in FUXA version 1.

CVE-2025-69971 [CRITICAL] CWE-798 CVE-2025-69971: FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The applicat FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.

CVE-2026-47717 [HIGH] CWE-201 CVE-2026-47717: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.

CVE-2026-25894 [CRITICAL] CWE-321 CVE-2026-25894: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default config FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not config

CVE-2025-69981 [CRITICAL] CWE-434 CVE-2025-69981: FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. Th FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload

CVE-2026-25893 [CRITICAL] CWE-285 CVE-2026-25893: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authen FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

CVE-2026-25938 [CRITICAL] CWE-290 CVE-2026-25938: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.

CVE-2023-31719 [CRITICAL] CWE-89 CVE-2023-31719: FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin. FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.

CVE-2026-25752 [CRITICAL] CWE-862 CVE-2026-25752: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vu FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communic

CVE-2026-43945 [HIGH] CWE-94 CVE-2026-43945: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3. FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes

CVE-2026-67443 [CRITICAL] CWE-862 CVE-2026-67443: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure, a remote unauthen

CVE-2026-43947 [HIGH] CWE-863 CVE-2026-43947: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unaut FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and exec

CVE-2025-69970 [CRITICAL] CWE-1188 CVE-2025-69970: FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipme

CVE-2025-69983 [CRITICAL] CWE-94 CVE-2025-69983: FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality. The application does not properly sanitize or sandbox user-supplied scripts within imported project files. An attacker can upload a malicious project containing system commands, leading to full system compromise.

CVE-2026-47719 [HIGH] CWE-918 CVE-2026-47719: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data. A remote unauthenticated attacker can make server/runtime/devices

CVE-2026-43946 [HIGH] CWE-863 CVE-2026-43946: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an autho FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.

CVE-2026-25951 [HIGH] CWE-22 CVE-2026-25951: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.11, there is a flaw in the path sanitization logic allows an authenticated attacker with administrative privileges to bypass directory traversal protections. By using nested traversal sequences (e.g., ....//), an attacker can write arbitrary files to the server filesy