CVE-2026-43945

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-43945
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43945.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-43945
Aliases
Published
2026-07-21T21:24:59.259Z
Modified
2026-07-25T03:56:41.035387244Z
Severity
  • 8.9 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
Details

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43945.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-284",
        "CWE-288",
        "CWE-863",
        "CWE-94"
    ]
}
References

Affected packages

Git / github.com/frangoteam/fuxa

Affected ranges

Type
GIT
Repo
https://github.com/frangoteam/fuxa
Events
Introduced
23abdb8291cfd94df7f1982f68ba4fe146e6073b
Fixed
c48f6560d8bc2e678322d2c5b21887d038a69c48
Database specific 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "1.2.11"
        },
        {
            "fixed": "1.3.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43945.json"