CVE-2026-43945

UNKNOWN 0.0

FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

CWE	CWE-94 CWE-284 CWE-288 CWE-863
Vendor	frangoteam
Product	fuxa
Published	Jul 21, 2026

Stay Ahead of the Next One

Get instant alerts for frangoteam fuxa

Be the first to know when new unknown vulnerabilities affecting frangoteam fuxa are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

frangoteam / FUXA

>= 1.2.11, < 1.3.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/frangoteam/FUXA/security/advisories/GHSA-p69w-mmfv-xrfj github.com: https://github.com/frangoteam/FUXA/releases/tag/v1.3.1