PT-2026-6662 · Fuxa · Fuxa

Wodzen · Published 2026-02-05 · Updated 2026-02-10 · CVE-2026-25752

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions FUXA versions through 1.2.9

Description FUXA is a web-based Process Visualization software. An authorization bypass allows a remote attacker to modify device tags via WebSockets. Exploitation bypasses role-based access controls, enabling attackers to overwrite device tags or disable communication drivers, potentially manipulating physical processes and disconnected devices. The runtime.settings.secureEnabled setting does not prevent exploitation.

Recommendations Update to version 1.2.10 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-25752

GHSA-GGXW-G3CP-MGF8

Affected Products

Fuxa

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25752.json · Exploit
• https://github.com/frangoteam/FUXA/security/advisories/GHSA-ggxw-g3cp-mgf8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ggxw-g3cp-mgf8 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25752 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25752 · Security Note
• https://github.com/frangoteam/FUXA · Note
• https://github.com/frangoteam/FUXA/releases/tag/v1.2.10 · Note
• https://github.com/frangoteam/FUXA/commit/eb2d8a20964ce7acaa0f442a181390a5f726a1ae · Note
• https://twitter.com/TheHackerWire/status/2021238366646436105 · Twitter Post
• https://t.me/CVEtracker/43949 · Telegram Post
• https://twitter.com/CVEnew/status/2019857593984819614 · Twitter Post