CVE-2026-67443
CriticalCVSS 9.2Summary
FUXA version 1.3.2 and earlier has a vulnerability in the allowDashboard authorization gate that allows a remote unauthenticated attacker to obtain a signed guest token and access the Node-RED editor and flow deployment API. The attacker can deploy malicious nodes or execute scripts, gaining control over project data, configuration, and potentially the operating system.
Risk Assessment
The attack can lead to full compromise of the SCADA/HMI system, including data theft, modification of industrial processes, and execution of system commands, posing a serious threat to critical infrastructure.
Recommendation
Update FUXA to version 1.3.3 or later, which includes the fix. Additionally, restrict network access to the server and monitor Node-RED activity.
Original NVD description (English source)
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure, a remote unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and use it to access the RED.httpAdmin editor and flow deployment API. Because the Node-RED configuration has no second adminAuth gate, the attacker can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript, gaining control of FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and potentially operating-system commands when nodeRedUnsafeModules is enabled. This issue is fixed in version 1.3.3.