CVE-2026-43945— FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| frangoteam | FUXA | >= 1.2.11, < 1.3.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-43945
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
Source: CVE Program / CVE List V5
Vulnerability Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Versions 1.2.11 until 1.3.1 allow an unauthenticated remote attacker to achieve Full Remote Code Execution (RCE) as root. The exploit succeeds even when the platform is configured in its most secure state (Secure Mode Enabled and Node-RED Secure Auth Enabled). Version 1.3.1 fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Vulnerability Title
frangoteam FUXA 权限许可和访问控制问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
frangoteam FUXA是frangoteam团队开源的一个基于web的过程可视化软件。 frangoteam FUXA 1.2.11版本至1.3.1之前版本存在安全漏洞，该漏洞源于代码注入、权限许可和访问控制以及授权问题，可能导致未经身份验证的远程攻击者实现以root权限的完全远程代码执行。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| frangoteam | FUXA | >= 1.2.11, < 1.3.1 | - |
II. Public POCs for CVE-2026-43945
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-43945
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-43945 (1)
Other References for CVE-2026-43945 (1)
- 🔗 Release v1.3.1 · frangoteam/FUXA · GitHubx_refsource_MISC
Same Patch Batch · frangoteam · 2026-07-21 · 3 CVEs total
| CVE-2026-43947 | 8.9 HIGH | FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorizatio |
| CVE-2026-43946 | FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue |
IV. Related Vulnerabilities
Same product: FUXA
- CVE-2026-43947
FUXA Vulnerable to Unauthenticated Remote Code Execution via - CVE-2026-43946
FUXA has an unauthenticated arbitrary tag value disclosure v - CVE-2026-25895
FUXA Unauthenticated Remote Code Execution via Arbitrary Fil - CVE-2026-25894
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT - CVE-2026-25893
FUXA Unauthenticated Remote Code Execution via Admin JWT Min
Same vendor: frangoteam
- CVE-2026-43947
FUXA Vulnerable to Unauthenticated Remote Code Execution via - CVE-2026-43946
FUXA has an unauthenticated arbitrary tag value disclosure v - CVE-2026-13207
Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing - CVE-2026-25895
FUXA Unauthenticated Remote Code Execution via Arbitrary Fil - CVE-2026-25894
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT
Same weakness: CWE-94
- CVE-2026-65693
Microweber CMS 2.0.20 Server-Side Template Injection via Mai - CVE-2026-16801
Devolutions PowerShell Universal代码注入漏洞 - CVE-2026-16800
Devolutions PowerShell Universal代码注入漏洞 - CVE-2025-71389
Cal.com before 5.9.9 Remote Code Execution via RSC - CVE-2026-47722
nebula-mesh: Host advanced overrides allow YAML injection in
V. Comments for CVE-2026-43945
No comments yet