PT-2026-5978 · Fuxa · Fuxa

Published 2026-02-03 · Updated 2026-02-10 · CVE-2025-69970

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions FUXA version 1.2.7

Description The software initializes with authentication disabled due to the 'secureEnabled' flag being commented out in the 'server/settings.default.js' file. This allows unauthenticated remote attackers to access sensitive ''API endpoints'', modify projects, and control industrial equipment immediately after installation.

Recommendations Ensure the 'secureEnabled' flag is uncommented in the 'server/settings.default.js' file to enable authentication.

Fix

XSS

Missing Authentication

Weakness Enumeration

CWE-1188

CWE-79

CWE-306

Related Identifiers

CVE-2025-69970

GHSA-R5M2-FQCF-QRF7

Affected Products

Fuxa

References · 7

• https://osv.dev/vulnerability/GHSA-r5m2-fqcf-qrf7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69970 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69970 · Vendor Advisory
• https://github.com/frangoteam/FUXA/blob · Note
• https://github.com/frangoteam/FUXA/blob/master/server/settings.default.js · Note
• https://t.me/cveNotify/151568 · Telegram Post
• https://twitter.com/TheHackerWire/status/2019438827262341200 · Twitter Post