CVE-2026-43947
HighCVSS 8.9Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
FUXA version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when secureEnabled is set to true. The POST /api/runscript endpoint checks authorization by script ID, but when test: true is set, it compiles and executes attacker-supplied code instead of the stored script. An unauthenticated attacker who knows a valid script ID and name can execute arbitrary code.
Risk Assessment
An unauthenticated attacker can remotely execute arbitrary code on the FUXA server, leading to full compromise of the SCADA/HMI system.
Recommendation
Update FUXA to version 1.3.1 and ensure secureEnabled is enabled and properly configured.
Other vulnerabilities in FUXA
See all- CVE-2026-67443Critical
FUXA version 1.3.2 and earlier has a vulnerability in the allowDashboard authorization gate that allows a remote unauthenticated attacker to obtain a signed guest token and access the Node-RED editor and flow deployment API. The attacker can deploy malicious nodes or execute scripts, gaining control over project data, configuration, and potentially the operating system.
- CVE-2026-67442Low
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.3, DELETE /api/roles removes role definitions but does not remove the deleted role identifier from user's info.roles array or runtime usersMap cache. This can lead to retained authorization rights after admin revocation.
- CVE-2026-67440Medium
FUXA version 1.3.2 and earlier does not check isSocketAdminAuthorized for certain Socket.IO events (DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, DEVICE_TAGS_REQUEST) when secureEnabled is true. A remote unauthenticated or guest user can collect system-discovery information not required for normal HMI viewing.
- CVE-2026-65985Medium
FUXA version 1.3.2 and earlier allows an authenticated non-admin user to control property.address in the device-webapi-request handler, causing the FUXA server to issue outbound HTTP/HTTPS requests and return the response to the attacker. This leads to an SSRF vulnerability.
- CVE-2026-65984High
FUXA version 1.3.2 and earlier improperly handled session refresh, allowing an attacker with a previously issued privileged refresh cookie or access token to continue minting privileged JWTs even after account deletion, disablement, role removal, or demotion. This enabled continued unauthorized access to user management, project manipulation, runtime configuration, and backdoor-account creation. The issue is fixed in version 1.3.3.
- CVE-2026-47721Medium
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler do not consistently enforce admin permissions. An authenticated non-admin operator can create or alter deviceActions or delete schedules, gaining access to device-value changes and server-side script execution.
- CVE-2026-47720Medium
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, the escapeTdString function does not escape backslashes, allowing a remote unauthenticated attacker to inject SQL via crafted sids tag identifiers. This can expose historical PLC tag values and device names.
- CVE-2026-47719High
FUXA before version 1.3.2 has a vulnerability allowing a remote unauthenticated attacker to perform SSRF (Server-Side Request Forgery) via the DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers. By manipulating property.address or endpoint connection data, the attacker can make the server call axios.get against arbitrary HTTP/HTTPS destinations, including internal services, cloud metadata, OPC UA, or ODBC services. The issue is fixed in version 1.3.2.
- CVE-2026-47718Medium
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
- CVE-2026-47717High
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue.
Original NVD description (English source)
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.