Fuxa
CVE-2025-69971
CRITICAL
GHSA-2r8f-cf6w-x5vq
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8, EPSS 4.8% — highest exploitation probability among FUXA vulnerabilities. Even if secureEnabled is turned on, the hard-coded JWT makes authentication meaningless. |
| Exploit ScenarioDerived | An attacker extracts the hard-coded JWT secret from FUXA's source code, forges an admin JWT token, and accesses the SCADA/HMI interface with full administrative privileges to control industrial processes. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
FUXA v1.2.7 has hard-coded JWT credentials (EPSS 4.8%) that allow attackers to forge authentication tokens and bypass all access controls on the SCADA interface.
Earlier versions of this analysis (1)
Hard-coded JWT secret in FUXA SCADA enables authentication bypass — highest exploitation risk.
RemediationAI
Update FUXA. Generate a unique JWT secret per installation. Rotate all tokens.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FUXA v1.2.7 uses a hard-coded JWT secret key in server/api/jwt-helper.js (CWE-798). Any attacker who discovers this key (easily extracted from the source code) can forge valid JWT tokens.
Know when Fuxa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.
Executive ViewAI
FUXA v1.2.7 uses a hard-coded secret key to sign authentication tokens, allowing attackers to forge valid credentials and gain unauthorized access to the application without legitimate authentication. Any organization running this version faces immediate risk of account takeover, data exfiltration, and system compromise, particularly if the application is internet-facing or processes sensitive data.
Implement network segmentation to restrict access to FUXA instances; deploy Web Application Firewall (WAF) rules to monitor and block suspicious JWT token patterns; enforce multi-factor authentication (MFA) for all application users; enable detailed logging and alerting on authentication events; consider disabling JWT-based authentication in favor of alternative credential mechanisms if operationally feasible; restrict API access to trusted IP ranges only. Note: These controls reduce but do not eliminate risk—vendor patch or version upgrade is essential.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Affected Products (CPE)CVE.org
Authentication bypass in FUXA SCADA/HMI system 1.2.8 and prior leading to Remote Code Execution. Unauthenticated attacke
FUXA SCADA has a path traversal vulnerability — ninth critical vulnerability enabling arbitrary file access on SCADA ser
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin. Rated critical severity (CVSS 9.8), this vulnerability is
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download. Rated high severity (CVSS 7.5), this vulnerabilit
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database. Rated high s
FUXA v1.2.7 allows remote code execution through the project import functionality by importing crafted project files con
FUXA SCADA has yet another authorization bypass — now the seventh critical FUXA vulnerability discovered, enabling unaut
FUXA SCADA has an authentication spoofing vulnerability from versions 1.2.8 through 1.2.10 — tenth critical vulnerabilit
FUXA SCADA has insecure default configuration with a known JWT secret — eighth critical vulnerability.
FUXA v1.2.7 has an unrestricted file upload in the /api/upload endpoint that lacks authentication and file type validati
FUXA v1.2.7 SCADA/HMI system has insecure default configuration with security disabled by default, exposing industrial c
Exploit-DB