CVE-2026-25938

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - security-advisories@github.com

Published

2026-02-09

Last modified

2026-02-11

Weaknesses

CWE-290, CWE-306

Affected products

• Fuxa (Frangoteam)

References

• https://github.com/frangoteam/FUXA/commit/5e7679b09718534e4501a146fdfe093da29af336
• https://github.com/frangoteam/FUXA/releases/tag/v1.2.11
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-v4p5-w6r3-2x4f