CVE-2026-25752
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
- Score
- CVSS 4.0 9.3 Critical
- Status
- Analyzed - security-advisories@github.com
- Published
- 2026-02-06
- Last modified
- 2026-02-09
- Weaknesses
- CWE-862
Affected products
References
- https://github.com/frangoteam/FUXA/releases/tag/v1.2.10
- https://github.com/frangoteam/FUXA/security/advisories/GHSA-ggxw-g3cp-mgf8
