p PatchFirst

CVE-2026-43947

CVE-2026-43947 · FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.

CVSS 8.9 · Alta · EPSS 0,9% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • fuxa

    Versiones
    • = 1.3.0: Afectada

    Sin corrección publicada

  • fuxa-server npm

    Versiones
    • 1.3.0
    Intervalos de versiones afectados
    • SEMVER: ≥ 1.3.0, < 1.3.1

    Actualiza a 1.3.1

Fuentes originales

Comprueba tu servidor →