PT-2026-6471 · Npm · Fuxa-Server

Publicado 2026-02-03 · Atualizado 2026-02-03

OSV

CVSS v4.0

8.0

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

GHSA-R5M2-FQCF-QRF7

Produtos afetados

Fuxa-Server

Referências · 4

• https://github.com/frangoteam/FUXA/blob/master/server/settings.default.js · Nota
• https://github.com/frangoteam/FUXA/blob · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-69970 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-r5m2-fqcf-qrf7 · Aviso do Fabricante