CVE Intelligence
Analysis AI-assisted

CVE-2025-69970: Frangoteam FUXA 1.2.7 Missing Authentication via Insecure Default Configuration

FUXA 1.2.7 initializes with authentication disabled because the 'secureEnabled' flag is commented out by default in server/settings.default.js. According to the CNA record, unauthenticated remote attackers could reach sensitive API endpoints, modify projects and control industrial equipment. The CNA assigned a CVSS 3.1 base score of 9.3 (critical), and no fixed version is listed in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

This CVE affects Frangoteam FUXA version 1.2.7. The CNA record describes an insecure default configuration in the file server/settings.default.js, where the 'secureEnabled' flag is commented out. As a result, the application starts with authentication disabled.

Impact

According to the CNA description, an unauthenticated remote attacker could access sensitive API endpoints, modify projects and control industrial equipment immediately after installation. The CNA vector indicates high confidentiality and integrity impact with no availability impact.

Affected products and versions

  • Frangoteam Fuxa, version 1.2.7 (as listed in the CNA record).
  • No other affected versions are listed in the sources consulted.

Exploitation status

The CISA KEV catalog does not list this CVE. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • No fixed version is listed in the record. Check the upstream FUXA repository for updates and for the current state of the default configuration.
  • Until a fix is confirmed, do not expose FUXA instances to untrusted networks, and restrict access to trusted administrators through network segmentation.
  • Review the default configuration file and ensure that authentication is enabled before the service is put into use.
  • Treat instances installed from default settings as potentially exposed and verify their configuration.

Detection guidance

  • Inventory all FUXA deployments and identify those running version 1.2.7.
  • Review web and API access logs for requests to administrative or project-management endpoints from unexpected sources.
  • Look for unexplained changes to projects or configurations, and compare them against known-good backups.

Limitations of the available information

  • The record does not list a fixed version, patch or vendor advisory.
  • The record does not describe the specific API endpoints affected.
  • No EPSS score or SSVC data is available.
  • The CVSS vector lists user interaction as required (UI:R), and the record does not explain this in detail.
  • The sources consulted do not confirm whether other FUXA versions are affected.

Frequently asked questions

What is the root cause of CVE-2025-69970?

According to the CNA record, the 'secureEnabled' flag in server/settings.default.js is commented out by default, so FUXA 1.2.7 starts with authentication disabled.

Is a fixed version available?

No fixed version is listed in the sources consulted. The status of a fix is unknown, so check the upstream FUXA repository for updates.

Is this CVE known to be exploited in the wild?

The CISA KEV catalog does not list this CVE, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.