CVE-2026-43947

Deferred Deferred - Pending Action

Unauthenticated Remote Code Execution in FUXA SCADA Software

Publication date: 2026-07-21

Last updated on: 2026-07-23

Assigner: GitHub, Inc.

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-23

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-09

NVD

CVE-2026-43947

Affected Vendors & Products

Vendor	Product	Version / Range
fuxa	fuxa	to 1.3.1 (exc)
fuxa	fuxa	1.3.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated Remote Code Execution flaw in FUXA version 1.3.0 when the secureEnabled setting is true. The POST /api/runscript endpoint allows attackers to execute arbitrary code by setting test: true in the request, bypassing normal authorization checks. An attacker only needs a valid script ID and name, which can be obtained via an unauthenticated information disclosure in GET /api/project.

Detection Guidance

Check if FUXA version 1.3.0 is running and if the secureEnabled setting is set to true. Verify if unauthenticated access to /api/project and /api/runscript endpoints is possible. Look for unusual script executions or network traffic patterns.

Impact Analysis

An unauthenticated attacker could execute arbitrary code on the server running FUXA 1.3.0 if at least one server-side script exists. This could lead to full system compromise, data theft, or disruption of operations. The attacker does not need credentials but requires knowledge of a valid script ID and name.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Compliance may be compromised if sensitive data is exposed or altered due to the remote code execution.

Mitigation Strategies

Upgrade FUXA to version 1.3.1 or later immediately. Disable unauthenticated access to /api/project and /api/runscript endpoints if possible. Ensure secureEnabled is set to true and restrict script permissions. Monitor for any signs of exploitation.

Hi! I’m here to help you understand CVE-2026-43947. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70