Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-02-06 | 2 | Disclosure1Patch1 |
| 2026-02-10 | 1 | Disclosure1 |
CVE-2026-25752 FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to … https://www.cve.org/CVERecord?id=CVE-2026-25752
Post summary
The post announces a new authorization bypass vulnerability in FUXA, describing its nature but not providing exploit code, patches, or evidence of active attacks.
🔴 CVE-2026-25752 - Critical FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags vi... https://www.thehackerwire.com/vulnerability/CVE-2026-25752/ https://t.co/vBm1T5PN5U
Post summary
A new critical CVE-2026-25752 has been disclosed for FUXA’s web-based process visualization software, highlighting an unauthenticated authorization bypass that could permit remote modification of device tags.
FUXA Server has an unauthenticated remote arbitrary device tag write vulnerability (CVE-2026-25752). Update to version 1.2.10. #fuxaserver #infosec #ICS https://www.pulsepatch.io/posts/cve-2026-25752-fuxa-server-unauthenticated-remote-write
Post summary
The post announces CVE-2026-25752 as an unauthenticated remote write vulnerability in FUXA Server and advises updating to version 1.2.10 to remediate the issue.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | frangoteam | fuxa | - | - | - |