CVE-2026-43945

Deferred Deferred - Pending Action

Unauthenticated Remote Code Execution in FUXA SCADA/HMI Software

Publication date: 2026-07-21

Last updated on: 2026-07-22

Assigner: GitHub, Inc.

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-22

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-43945

Affected Vendors & Products

Vendor	Product	Version / Range
fuxa	process_visualization	to 1.3.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-288	The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

Executive Summary

CVE-2026-43945 is a vulnerability in FUXA, a web-based Process Visualization software. It allows an unauthenticated remote attacker to execute arbitrary code with full system privileges (root access) on affected systems. The flaw exists in versions 1.2.11 through 1.3.1 and can be exploited even when the software is configured in its most secure state.

Detection Guidance

Detecting this vulnerability requires checking the installed version of FUXA. Run 'npm list -g fuxa' or check the version in the FUXA web interface. If the version is between 1.2.11 and 1.3.1, the system is vulnerable.

Impact Analysis

This vulnerability allows attackers to gain complete control over the affected system. They could install malware, steal sensitive data, disrupt operations, or use the compromised system as a pivot point to attack other systems in the network. The impact includes potential data breaches, system downtime, and unauthorized access to critical infrastructure.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR, HIPAA, and other regulations due to unauthorized access to sensitive data. Organizations may face legal penalties, fines, and reputational damage if this flaw results in data breaches or unauthorized disclosures of protected health or personal information.

Mitigation Strategies

Upgrade FUXA to version 1.3.1 or later immediately. If upgrading is not possible, isolate the system from untrusted networks and disable external access until patched.

Hi! I’m here to help you understand CVE-2026-43945. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70