CVE-2026-43945

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

CVSS

No CVSS.

References

Link	Resource
https://github.com/frangoteam/FUXA/releases/tag/v1.3.1
https://github.com/frangoteam/FUXA/security/advisories/GHSA-p69w-mmfv-xrfj

Configurations

No configuration.

History

24 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) FUXA es un software de visualización de procesos (SCADA/HMI/Dashboard) basado en web. Las versiones 1.2.11 hasta 1.3.1 permiten a un atacante remoto no autenticado lograr la ejecución remota de código (RCE) completa como root. El exploit tiene éxito incluso cuando la plataforma está configurada en su estado más seguro (Modo Seguro Habilitado y Autenticación Segura de Node-RED Habilitada). La versión 1.3.1 corrige el problema.

Information

Published : 2026-07-21 22:17

Updated : 2026-10-24 19:10

NVD link : CVE-2026-43945

Mitre link : CVE-2026-43945

CVE.ORG link : CVE-2026-43945

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE-284

Improper Access Control

CWE-288

Authentication Bypass Using an Alternate Path or Channel

CWE-863

Incorrect Authorization

{"id": "CVE-2026-43945", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43945", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-22T18:22:02.620555Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "frangoteam", "product": "FUXA", "versions": [{"status": "affected", "version": ">= 1.2.11, < 1.3.1"}]}]}], "published": "2026-07-21T22:17:01.250", "references": [{"url": "https://github.com/frangoteam/FUXA/releases/tag/v1.3.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-p69w-mmfv-xrfj", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-94"}, {"lang": "en", "value": "CWE-284"}, {"lang": "en", "value": "CWE-288"}, {"lang": "en", "value": "CWE-863"}]}], "descriptions": [{"lang": "en", "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue."}, {"lang": "es", "value": "FUXA es un software de visualizaci\u00f3n de procesos (SCADA/HMI/Dashboard) basado en web. Las versiones 1.2.11 hasta 1.3.1 permiten a un atacante remoto no autenticado lograr la ejecuci\u00f3n remota de c\u00f3digo (RCE) completa como root. El exploit tiene \u00e9xito incluso cuando la plataforma est\u00e1 configurada en su estado m\u00e1s seguro (Modo Seguro Habilitado y Autenticaci\u00f3n Segura de Node-RED Habilitada). La versi\u00f3n 1.3.1 corrige el problema."}], "lastModified": "2026-10-24T19:10:00.127", "sourceIdentifier": "security-advisories@github.com"}