CVE-2026-25894CWE-1188CWE-321

FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration

Critical · published February 9, 2026

CVSS v4.0
9.5
EPSS
1%
Percentile
72.1
In the wild
Unconfirmed
What it is

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10.

The record
Technical detail
CVSS v4.0
9.5 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.01390 · 72.1th percentile
Weaknesses
CWE-1188 · Initialization of a Resource with an Insecure Default; CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-02-09T22:28Z
EPSS history
Timeline
  • 09 FEB 22:28Z
    FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
    cvelistv5