CVE-2025-69985

FUXA ≤ 1.2.8 Bypass di Autenticazione + RCE CVE-2025-69985 📜 Descrizione Questo exploit Python sfrutta CVE-2025-69985, una vulnerabilità critica di bypass di autenticazione in FUXA software SCADA/HMI basato sul web versione ≤ 1.2.8. Inviando un payload JSON modificato con codice Node.js incorpora...

FUXAPWN

CVE-2026-25895 — FUXA = 1.2.9 अप्रमाणित पथ-भ्रमण से दूरस्थ कोड निष्पादन FUXA, एक Node.js-आधारित SCADA/HMI प्लेटफ़ॉर्म, के विरुद्ध अप्रमाणित, प्री-ऑथ मनमाना फ़ाइल लेखन। लिखने के बाद कई अलग-अलग प्राइमिटिव के माध्यम से दूरस्थ कोड निष्पादन की श्रृंखला। यह तब भी काम करता है जब secureEnabled = true...

CVE-2025-69985

CVE-2025-69985: استغلال لتجاوز المصادقة إلى تنفيذ التعليمات البرمجية عن بُعد RCE في FUXA ≤1.2.8 📌 نظرة عامة يحتوي هذا المستودع على إثبات المفهوم PoC وتوثيق تقني مفصل حول الثغرة الأمنية CVE-2025-69985 ، التي تؤثر على FUXA الإصدارات ≤1.2.8. تسمح هذه الثغرة لمهاجم غير مصادق بتنفيذ أوامر عشوائية على...

CVE-2026-47720

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a...

CVE-2026-67443 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

CVE-2026-67443 FUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is tru...

CVE-2026-65985 FUXA: SSRF hardening for `device-webapi-request`

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the device-webapi-request Socket.IO handler in server/runtime/index.js permits an authenticated non-admin runtime user to control property.address, causing the FUXA server to issue an outbound HTTP or...

PT-2026-77308

Name of the Vulnerable Software and Affected Versions FUXA versions prior to 1.3.3 Description An authorization bypass exists in the allowDashboard gate within server/integrations/node-red/index.js where authJwt.verify is called for the /nodered endpoint without inspecting the decoded identity...

CVE-2026-47717

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue...

CVE-2026-47718 FUXA provides guest and invalid-token access to protected read APIs in secure mode

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. When secureEnabled=true, FUXA 1.3.0-2773 still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue...

CVE-2026-47717

FUXA 1.3.0 is vulnerable: GET /api/project allows unauthenticated/guest-context access to full project data despite secureEnabled, due to secureFnc auto-generating a guest token. Impact includes server-side scripts, device configurations, HMI views (SVG and bindings), and alarm definitions. Versi...

CVE-2026-47717 FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In fuxa-server version 1.3.0, the GET /api/project endpoint exposes sensitive project configuration data to guest-context requests even when secureEnabled is enabled. Version 1.3.1 fixes the issue...

FUXA 1.2.8 - Authentication Bypass + RCE Exploit

Exploit Title: FUXA 1.2.8 - Authentication Bypass + RCE Exploit Date: 2026-02-25 Exploit Author: Joshua van der Poll https://github.com/joshuavanderpoll/ Software Link: https://github.com/frangoteam/FUXA/tree/v1.2.8 Vendor Homepage: https://github.com/frangoteam/FUXA Version: FUXA 1.2.8. Do not u...

Improper Authentication

Overview fuxa-server is a Web-based Process Visualization SCADA/HMI/Dashboard software Affected versions of this package are vulnerable to Improper Authentication via the authentication process. An attacker can gain administrative access and execute arbitrary code by bypassing authentication...

Siemens WinCC OA

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Siemens Equipment: SIMATIC WinCC OA Vulnerability: Use of Client-side Authentication CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found in multiple operational...

Siemens SIMATIC WinCC (Update E)

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please seeSiemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2018-17904

Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code...

CVE-2018-17904

Reliance 4 SCADA/HMI, Version 4.7.3 Update 3 and prior. This vulnerability could allow an unauthorized attacker to inject arbitrary code...

7-Technologies IGSS Denial of Service (Update A)

Overview ICS-CERT has become aware of multiple denial-of-service DoS vulnerabilities in the 7-Technologies 7T Interactive Graphical SCADA System IGSS supervisory control and data acquisition SCADA human-machine interface HMI application. All vulnerabilities are remotely exploitable. 7T has...

Information Disclosure Vulnerability in Taiwan Tibbo Group AggreGate SCADA-HMI Industrial Software

AggreGate SCADA/HMI is a system for visualizing and operating processes, production flows, machines and equipment. It is a multi-user distributed solution that provides monitoring and surveillance for many industries. An information disclosure vulnerability exists in Taiwan Tibbo Group's AggreGat...