CVE-2026-25894
Unauthenticated Remote Code Execution in FUXA via JWT Misconfiguration
Publication date: 2026-02-09
Last updated on: 2026-02-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| frangoteam | fuxa | to 1.2.10 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-1188 | The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure. |
| CWE-321 | The product uses a hard-coded, unchangeable cryptographic key. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FUXA, a web-based Process Visualization software used for SCADA, HMI, and dashboards. Due to an insecure default configuration, if the administrator JWT secret is not set while authentication is enabled, an unauthenticated remote attacker can gain administrative access to the system.
Once administrative access is obtained, the attacker can execute arbitrary code on the server, potentially taking full control of the affected system.
This issue affects versions of FUXA up to 1.2.9 and has been fixed in version 1.2.10.
How can this vulnerability impact me? :
The vulnerability allows an unauthenticated attacker to gain administrative access and execute arbitrary code on the server running FUXA.
This can lead to full compromise of the affected system, including unauthorized control over process visualization and potentially critical industrial control systems.
Such a compromise could result in disruption of operations, data theft, manipulation of process data, or further attacks within the network.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade FUXA to version 1.2.10 or later where the issue has been patched.
Ensure that the administrator JWT secret is properly configured to prevent unauthenticated remote administrative access.