FUXA CVE-2026-42949

Exploitation requires a FUXA 1.3.2-2809 instance whose HTTP interface - specifically the /api/runscript endpoint - is reachable by the attacker; per the CVSS vector's PR:N no authentication is needed and no user interaction is required. The practical limiting factor is exposure: FUXA is typically deployed as an HMI/SCADA front-end on internal OT/engineering networks rather than internet-facing, so reachability is the main gate. The sources do not describe the exact malformation that makes the request 'specially crafted', so the specific trigger condition behind the input's AC:H rating is not described in the available sources.

This is a medium-severity (CVSS 5.6) authorization-bypass issue (CWE-285) in FUXA's /api/runscript endpoint. The provided CVSS vector (AV:N/PR:N/UI:N) is the concerning part: it is network-reachable and, per the vector's PR:N, unauthenticated with no user interaction, which normally argues for prioritization. However, several signals pull the real-world urgency down: the supplied vector sets AC:H and caps all three impacts at Low (C:L/I:L/A:L), the vuln.today decision label is 'this_month' (not act_now/emergency), and there is no EPSS score, no CISA KEV listing, and no confirmed public exploit code in the input. Note a tension to verify with the vendor/Talos: the vector marks AC:H, yet the description characterizes the trigger as a single 'specially crafted' unauthenticated HTTP request, which reads as low complexity - the AC:H justification is not explained in the available sources. Also note the impact rating (all Low) seems conservative for an endpoint literally named 'runscript' that 'executes a privileged operation'; if that endpoint can run server-side scripts, real integrity/availability impact could be higher, but the sources do not confirm the scope of what the script can do. Net: a legitimate, verified Talos-reported flaw worth patching on a normal cycle rather than an emergency, with footprint concentrated in environments actually running this niche SCADA/HMI product.

An attacker with network access to a FUXA 1.3.2-2809 instance sends a crafted, unauthenticated HTTP request directly to the /api/runscript endpoint, bypassing the authorization check and invoking a privileged operation that should require authentication. No public exploit code is confirmed in the sources, though Talos report TALOS-2026-2417 documents the vulnerability.