CVE-2026-43945CWE-284CWE-288CWE-863CWE-94

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

High · published July 21, 2026

CVSS v4.0
8.9
EPSS
1%
Percentile
57.4
In the wild
Unconfirmed
What it is

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

The record
Technical detail
CVSS v4.0
8.9 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00839 · 57.4th percentile
Weaknesses
CWE-284 · Improper Access Control; CWE-288 · Authentication Bypass Using an Alternate Path or Channel; CWE-863 · Incorrect Authorization; CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2026-07-21T21:24Z
EPSS history
Timeline
  • 21 JUL 21:24Z
    FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
    cvelistv5