CVE-2026-25893 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboa… | CVSS 10.0 CRITICAL

Description

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

Metadata

CVE ID: CVE-2026-25893
State: PUBLISHED
Assigner: GitHub_M
Reserved: 2026-02-06 21:08 UTC
Published: 2026-02-09 22:26 UTC
Last updated: 2026-02-11 21:25 UTC
Primary CWE: CWE-285
CWE-285: Improper Authorization
Vendor / Product: frangoteam / FUXA
Sources: cve.org · NVD

Severity & Metrics

10.0 CRITICAL CVSS 4.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: total

Affected products (1)

Vendor	Product	Platform	Versions
frangoteam	FUXA	—	< 1.2.10

Weakness (CWE)

CWE	Source	Description
CWE-285	cna	CWE-285: Improper Authorization
CWE-287	cna	CWE-287: Improper Authentication

CVSS scores (1)

Score	Severity	Version	Source	Vector
10.0	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References (2)

https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822 https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822
https://github.com/frangoteam/FUXA/commit/fe82348d160904d0013b9a3e267d50158f5c7afb https://github.com/frangoteam/FUXA/commit/fe82348d160904d0013b9a3e267d50158f5c7afb