CVE-2026-43945 - FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

Back Back to CVE browser

HIGH

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

Published Jul 21, 2026

8.9

HIGH

CVSS 4.0

EPSS 0.84%

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

Affected products

Vendor Frangoteam Product FUXA Default
n/a
- Version
  >= 1.2.11, < 1.3.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Frangoteam

FUXA

n/a

Version	Status	Constraints
>= 1.2.11, < 1.3.1	affected	-

Ecosystem	Package	Introduced	Fixed
npm	@frangoteam/fuxa	1.2.11	1.3.1

Remediation

No remediation recorded yet.

Weaknesses (4)

CWE-284

CWE-288

CWE-863

Incorrect Authorization

CWE-94

Code Injection

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46441
Advisory
https://github.com/advisories/GHSA-p69w-mmfv-xrfj
Advisory
https://github.com/frangoteam/FUXA/releases/tag/v1.3.1
x_refsource_MISC
https://github.com/frangoteam/FUXA/security/advisories/GHSA-p69w-mmfv-xrfj
x_refsource_CONFIRM

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-46441		Advisory
https://github.com/advisories/GHSA-p69w-mmfv-xrfj		Advisory
https://github.com/frangoteam/FUXA/releases/tag/v1.3.1		x_refsource_MISC
https://github.com/frangoteam/FUXA/security/advisories/GHSA-p69w-mmfv-xrfj		x_refsource_CONFIRM