CVE-2025-69970

critical · 9.3

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

9.3

CVSS

0.5%

EPSS (exploit prob.)

40th

EPSS percentile

2026-02-03

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Weaknesses

CWE-1188

Affected products

Vendor	Product	Affected versions
frangoteam	fuxa	1.2.7

Check a specific version with /api/v1/cve/match.

References

https://github.com/frangoteam/FUXA/blob/master/server/settings.default.js

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-69970