CVE-2026-25938

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-25938
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25938.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-25938
Aliases
Published
2026-02-09T22:18:15.774Z
Modified
2026-03-02T19:56:34.356965Z
Severity
  • 9.5 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CVSS Calculator
Summary
FUXA Unauthenticated Remote Code Execution in Node-RED Integration
Details

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-290",
        "CWE-306"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25938.json"
}
References

Affected packages

Git / github.com/frangoteam/fuxa

Affected ranges

Type
GIT
Repo
https://github.com/frangoteam/fuxa
Events
Introduced
5d8463f5d1cf6fac512ff3f4c6889901330c4c21
Fixed
23abdb8291cfd94df7f1982f68ba4fe146e6073b

Affected versions

v1.*
v1.2.10
v1.2.8
v1.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-25938.json"