CVE Intelligence
Analysis AI-assisted

CVE-2026-25752: FUXA Missing Authorization in WebSocket Device Tag Modification

CVE-2026-25752 is an authorization bypass in FUXA, a web-based SCADA/HMI application, that lets an unauthenticated remote attacker modify device tags through WebSockets. According to the record, the issue affects FUXA through version 1.2.9 and is patched in version 1.2.10. No confirmed exploitation appears in the sources consulted, and the record does not list KEV status.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

FUXA is a web-based process visualization application used for SCADA, HMI and dashboard functions. CVE-2026-25752 describes an authorization bypass that allows an unauthenticated remote attacker to modify device tags through WebSockets. The weakness is classified as CWE-862 (Missing Authorization).

Impact

  • According to the record, an attacker could bypass role-based access controls, overwrite arbitrary device tags, or disable communication drivers.
  • The record states this could expose connected ICS/SCADA environments to follow-on actions and allow manipulation of physical processes and disconnected devices from the HMI.
  • NVD lists a CVSS 3.1 base score of 9.1, and the GitHub CNA lists a CVSS 4.0 score of 9.3.

Affected products and versions

  • The record lists Frangoteam Fuxa with versions below 1.2.10.
  • The description states that FUXA through version 1.2.9 is affected and that the issue is patched in version 1.2.10.
  • The record's fixes list is empty, but the release page for version 1.2.10 is cited in the references.

Exploitation status

The record shows that the vulnerability is not listed in CISA KEV. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade FUXA to version 1.2.10 or later, as stated in the record and the release notes.
  • Until the upgrade is complete, limit network access to FUXA web and WebSocket interfaces to trusted operator networks, and avoid exposing the HMI directly to the internet.
  • Review role configurations and verify device tag values and driver states for unexpected changes.

Detection guidance

  • Monitor for unexpected changes to device tags or communication driver status in FUXA.
  • Correlate WebSocket sessions from unfamiliar sources with tag write events.
  • Review access logs for connections to the HMI from hosts that are not part of approved operations.

Limitations of the available information

  • The record does not describe the technical mechanism, the specific endpoints involved, or the preconditions beyond the lack of authentication.
  • The record does not mention public proof-of-concept code or exploit availability.
  • The record includes an EPSS probability of 0.00738 with a percentile of 0.53337, but the date field should be considered when interpreting these values.

Frequently asked questions

What is the core problem in CVE-2026-25752?

FUXA has an authorization bypass that lets an unauthenticated remote attacker modify device tags through WebSockets. The weakness is classified as Missing Authorization (CWE-862).

Which FUXA versions are affected?

According to the record, FUXA through version 1.2.9 is affected. The issue is patched in version 1.2.10.

What should administrators do?

Upgrade FUXA to version 1.2.10 or later. Until then, restrict network access to FUXA web and WebSocket interfaces and monitor for unexpected tag or driver changes.

Is this vulnerability known to be exploited?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.