PT-2026-6661 · Fuxa+1 · Fuxa+1

Wodzen · Published 2026-02-05 · Updated 2026-02-06 · CVE-2026-25751

Positive Technologies (AI Summary)

CVSS v4.0

9.1

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions FUXA versions through 1.2.9

Description An information disclosure issue in FUXA allows a remote, unauthenticated attacker to obtain sensitive administrative database credentials. Exploitation allows an attacker to access the full system configuration, including administrative credentials for the InfluxDB database. This access may allow an attacker to read, modify, or delete historical process data, or cause a Denial of Service by corrupting the database. This affects all deployments, including those with runtime.settings.secureEnabled set to true.

Recommendations Update to FUXA version 1.2.10 or later.

Exploit

Fix

DoS

Cleartext Storage of Sensitive Information

Missing Authentication

Weakness Enumeration

CWE-312

CWE-306

Related Identifiers

CVE-2026-25751

GHSA-C5GQ-4H56-4MMX

Affected Products

Fuxa

Influxdb

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25751.json · Exploit
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-c5gq-4h56-4mmx · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-c5gq-4h56-4mmx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25751 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25751 · Vendor Advisory
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/releases/tag/v1.2.10 · Note
• https://github.com/frangoteam/FUXA/commit/c6c4cba1a62545e8e3ae0f43b2269e61209fbee8 · Note
• https://t.me/CVEtracker/43948 · Telegram Post
• https://twitter.com/CVEnew/status/2019857593120813115 · Twitter Post