CVE-2026-25939

This repository contains a functional Python exploit for CVE-2026-25939, an unauthenticated remote arbitrary scheduler write vulnerability in FUXA versions 1.2.8 to 1.2.10. The exploit demonstrates creating, verifying, and deleting schedulers via the /api/scheduler endpoint without authentication.

This is a functional exploit PoC for CVE-2026-25939, targeting an authentication bypass in FUXA's scheduler API. It demonstrates unauthenticated creation, modification, and deletion of schedulers, which can lead to remote code execution in SCADA/ICS environments.