CVE-2026-25752

The record

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Affected packages

Related vulnerabilities

• GHSA-ggxw-g3cp-mgf8 FUXA Unauthenticated Remote Arbitrary Device Tag Write Same vulnerability
• CVE-2026-47720 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
• CVE-2026-47719 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
• CVE-2026-47721 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Also affects fuxa-server
• GHSA-8ghr-w65f-j3qr FUXA's scheduler API missing admin check enables operator-to-admin escalation via… Also affects fuxa-server
• GHSA-h9fj-c2qr-76g2 FUXA has SQL Injection in its TDengine DAQ connector via backslash bypass of… Also affects fuxa-server
• GHSA-w86f-rf9w-h3x6 FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with… Also affects fuxa-server
• GHSA-r9g5-7q8j-958c FUXA provides guest and invalid-token access to protected read APIs in secure mode Also affects fuxa-server