Skip to main content

SCADA CVE-2026-25938

CRITICAL
Authentication Bypass by Spoofing (CWE-290)
2026-02-09 security-advisories@github.com GHSA-v4p5-w6r3-2x4f
Authentication Bypass SCADA Fuxa
9.8
CVSS 3.1
Share

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
Patch released
Feb 13, 2026 - 20:31 nvd
Patch available
CVE Published
Feb 09, 2026 - 23:16 nvd
CRITICAL 9.8

DescriptionNVD

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. From 1.2.8 through 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to execute arbitrary code on the server when the Node-RED plugin is enabled. This has been patched in FUXA version 1.2.11.

AnalysisAI

FUXA SCADA has an authentication spoofing vulnerability from versions 1.2.8 through 1.2.10 — tenth critical vulnerability.

Sign in for full analysis, threat intelligence, and remediation guidance.

RemediationAI

Within 24 hours: Identify all systems running FUXA 1.2.8-1.2.10 and assess Node-RED plugin enablement status; isolate critical instances from production networks if patching cannot occur immediately. Within 7 days: Apply available vendor patch to all affected systems and validate remediation. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Share

CVE-2026-25938 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy