CVE-2026-25893

critical · 10

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

CVSS

0.7%

EPSS (exploit prob.)

52nd

EPSS percentile

2026-02-09

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-285CWE-287

Affected products

Vendor	Product	Affected versions
frangoteam	fuxa	< 1.2.10

Check a specific version with /api/v1/cve/match.

References

https://github.com/frangoteam/FUXA/commit/fe82348d160904d0013b9a3e267d50158f5c7afb
https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-25893