Fuxa
CVE-2025-69981
CRITICAL
GHSA-7g56-fwxj-cm23
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 9.8 — third FUXA vulnerability. Combined with insecure defaults and hard-coded JWT, the file upload provides a direct RCE path on SCADA infrastructure. |
| Exploit ScenarioDerived | An attacker uploads a reverse shell through the unauthenticated /api/upload endpoint, gaining OS-level access to the SCADA server and the ability to manipulate industrial process controls. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 12, 2026
FUXA v1.2.7 has an unrestricted file upload in the /api/upload endpoint that lacks authentication and file type validation, enabling web shell deployment on SCADA systems.
Earlier versions of this analysis (1)
Unauthenticated file upload in FUXA SCADA enables web shell on industrial control system.
RemediationAI
Implement authentication and file type validation on the upload endpoint. Update FUXA.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The /api/upload endpoint in FUXA v1.2.7 has a CWE-434 unrestricted file upload without authentication (combined with CWE-306), allowing any attacker to upload executable files to the SCADA server.
Know when Fuxa gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
DescriptionCVE.org
FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the /api/upload API endpoint. The endpoint lacks authentication mechanisms, allowing unauthenticated remote attackers to upload arbitrary files. This can be exploited to overwrite critical system files (such as the SQLite user database) to gain administrative access, or to upload malicious scripts to execute arbitrary code.
Executive ViewAI
FUXA v1.2.7 deployments face immediate risk from an unauthenticated file upload vulnerability that allows attackers to inject malicious code without credentials. This could lead to complete system compromise, data theft, or service disruption affecting all dependent business operations.
Disable the /api/upload endpoint if not operationally required. Implement network-level access controls restricting API access to trusted networks only. Deploy WAF rules to enforce authentication headers and file type validation. Monitor upload directories and access logs for suspicious activity. Store uploads in isolated, non-executable storage. Consider placing FUXA behind a reverse proxy requiring pre-authentication.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Affected Products (CPE)CVE.org
FUXA v1.2.7 has hard-coded JWT credentials (EPSS 4.8%) that allow attackers to forge authentication tokens and bypass al
Authentication bypass in FUXA SCADA/HMI system 1.2.8 and prior leading to Remote Code Execution. Unauthenticated attacke
FUXA SCADA has a path traversal vulnerability — ninth critical vulnerability enabling arbitrary file access on SCADA ser
FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin. Rated critical severity (CVSS 9.8), this vulnerability is
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute
FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download. Rated high severity (CVSS 7.5), this vulnerabilit
A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database. Rated high s
FUXA v1.2.7 allows remote code execution through the project import functionality by importing crafted project files con
FUXA SCADA has yet another authorization bypass — now the seventh critical FUXA vulnerability discovered, enabling unaut
FUXA SCADA has an authentication spoofing vulnerability from versions 1.2.8 through 1.2.10 — tenth critical vulnerabilit
FUXA SCADA has insecure default configuration with a known JWT secret — eighth critical vulnerability.
FUXA v1.2.7 SCADA/HMI system has insecure default configuration with security disabled by default, exposing industrial c
Exploit-DB