judgedbykira

GitHub · Repository owner · Source ID 176966274
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

judgedbykira/CVE-2026-25938-FUXA-Unauthenticated-RCE

Repository PoC1Created 2026-08-13ExploitCVE-2026-259382 files

12.3 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that sends a crafted Node-RED flow to a vulnerable FUXA server's payload withheld endpoint to establish a reverse shell, achieving unauthenticated remote code execution.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script and documentation for CVE-2026-25938, an unauthenticated RCE in FUXA. The script sends a user-supplied reverse shell command to a target server. All behavior is consistent with the disclosed exploit; no concealed, deceptive, or unrelated harmful actions were found.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPython
Target softwareFUXA
Attack typesRemote Code ExecutionAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The Python script constructs and sends a malicious payload to a vulnerable endpoint with the intent of executing arbitrary commands on the target server, which is the definition of an exploit.

CVE-2026-25938.py:15-80CVE-2026-25938.py:82-87

Requirements

  • Target FUXA server version 1.2.8 through 1.2.10 with Node-RED plugin enabled.README.md:9
  • Attacker must have a listener ready to receive the reverse shell connection.CVE-2026-25938.py:15

Observed behavior

  • Sends an HTTP POST request to payload withheld with a JSON payload containing a Node-RED flow that includes an exec node configured to execute a bash reverse shell command.CVE-2026-25938.py:20-74
  • Prints success or failure message based on HTTP response status code (200 or 204).CVE-2026-25938.py:75-78
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell
Payload withheldThe exploit payload sends a reverse shell to the operator's specified IP and port, which is the disclosed purpose of the PoC.CVE-2026-25938.py:54
Target Endpoint
Payload withheldThe script sends a POST request to this endpoint on the target server to deploy a malicious Node-RED flow.CVE-2026-25938.py:22
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.