Sign in
Deutsch English Español Polski
Critical

FUXA Unauthenticated Remote Arbitrary Device Tag Write

  • Disclosed: 05.02.2026
  • Updated: 11.10.2026 10:22

Summary

Description An authorization bypass vulnerability in FUXA allows an unauthenticated, remote attacker to modify device tags via WebSockets. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.

Impact

This affects all deployments, including those with runtime.settings.secureEnabled set to true.

Exploitation allows an unauthenticated, remote attacker to bypass role-based access controls and overwrite arbitrary device tags or disable communication drivers, exposing connected ICS/SCADA environments to follow-on actions. This may allow an attacker to manipulate physical processes and disconnected devices from the HMI.

Patches

This issue has been patched in FUXA version 1.2.10. Users are strongly encouraged to update to the latest available release.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package fuxa-server < 1.2.10 1.2.10

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:L/SI:H/SA:H
Weakness (CWE)
CWE-862
Platform
npm
Package
fuxa-server
Disclosed
05.02.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-ggxw-g3cp-mgf8 - CC BY 4.0

Vulnerability history: fuxa-server

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (21) in the archive
Total entries
21
First → latest
09.2023 06.2026
Without a fix
9
Exploited in attacks
0

Severity breakdown

  • Critical 8
  • High 10
  • Medium 3

Disclosures per year

Severity:
  1. FUXA: Unauthenticated SSRF via Socket.IO DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY with response reading
    High · 8.2 CVE-2026-47719 <= 1.1.14-1243 no fix
  2. FUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device Configurations
    High · 7.5 CVE-2026-47717 >= 1.3.0, < 1.3.1 1.3.1
  3. FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
    High CVE-2026-43947 >= 1.3.0, < 1.3.1 1.3.1
  4. FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
    High CVE-2026-43946 >= 1.3.0, < 1.3.1 1.3.1
  5. FUXA Affected by a Path Traversal Sanitization Bypass
    High CVE-2026-25951 < 1.2.11 1.2.11
  6. FUXA Unauthenticated Remote Arbitrary Scheduler Write
    Critical CVE-2026-25939 >= 1.2.8, < 1.2.11 1.2.11
  7. FUXA Unauthenticated Remote Code Execution in Node-RED Integration
    Critical CVE-2026-25938 >= 1.2.8, < 1.2.11 1.2.11
  8. FUXA Unauthenticated Remote Arbitrary Device Tag Write this entry
    Critical CVE-2026-25752 < 1.2.10 1.2.10
  9. FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
    Critical CVE-2026-25895 < 1.2.10 1.2.10
  10. FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
    Critical CVE-2026-25894 < 1.2.10 1.2.10
  11. FUXA Unauthenticated Exposure of Plaintext Database Credentials
    Critical CVE-2026-25751 < 1.2.10 1.2.10
  12. FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
    Critical CVE-2026-25893 < 1.2.10 1.2.10
  13. FUXA allows Remote Code Execution (RCE) via the project import functionality.
    High · 9.8 CVE-2025-69983 <= 1.2.7 no fix
  14. FUXA contains an Unrestricted File Upload vulnerability
    High CVE-2025-69981 <= 1.2.7 no fix
  15. FUXA contains an insecure default configuration vulnerability
    High CVE-2025-69970 <= 1.2.7 no fix
  16. FUXA SQL Injection vulnerability
    Critical · 9.8 CVE-2023-31719 <= 1.1.12 no fix
  17. FUXA local file inclusion vulnerability
    High · 7.5 CVE-2023-31718 <= 1.1.12 no fix
  18. FUXA SQL Injection vulnerability
    High · 7.5 CVE-2023-31717 <= 1.1.12 no fix

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.