CVE-2025-69971
CRITICAL
GHSA-2r8f-cf6w-x5vq
9.8
CVSS 3.1
Share
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Lifecycle Timeline
2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Feb 03, 2026 - 18:16 nvd
CRITICAL 9.8
Description
FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js. The application uses a hard-coded secret key to sign and verify JWT Tokens. This allows remote attackers to forge valid admin tokens and bypass authentication to gain full administrative access.
Analysis
FUXA v1.2.7 has hard-coded JWT credentials (EPSS 4.8%) that allow attackers to forge authentication tokens and bypass all access controls on the SCADA interface.
Technical Context
FUXA v1.2.7 uses a hard-coded JWT secret key in server/api/jwt-helper.js (CWE-798). Any attacker who discovers this key (easily extracted from the source code) can forge valid JWT tokens.
Affected Products
['FUXA v1.2.7']
Remediation
Update FUXA. Generate a unique JWT secret per installation. Rotate all tokens.
Priority Score
54
Low
Medium
High
Critical
KEV: 0
EPSS: +4.8
CVSS: +49
POC: 0
Share
External POC / Exploit Code
Leaving vuln.today
Destination URL
POC code from unknown sources may be malicious, contain backdoors, or be fake.
Always review and test exploit code in a safe, isolated environment (VM/sandbox).
Verify the source reputation and cross-reference with known databases (Exploit-DB, GitHub Security).