CVE-2026-43945

HIGH

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

Title source: cna
STIX 2.1

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

References (2)

Core 2
Core References
X_Refsource_Misc x_refsource_misc
https://github.com/frangoteam/FUXA/releases/tag/v1.3.1

Scores

CVSS v4 8.9
EPSS 0.0086
EPSS Percentile 55.0%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact total

Details

CWE
CWE-284 CWE-288 CWE-863 CWE-94
Status published
Products (1)
frangoteam/FUXA >= 1.2.11, < 1.3.1
Published Jul 21, 2026
Tracked Since Jul 22, 2026