FUXA EUVD-2026-112581

The exact prerequisite is a network-reachable FUXA 1.3.2-2809 instance exposing the /nodered functionality (FUXA's Node-RED integration endpoint); a crafted HTTP request to that endpoint bypasses the authorization control (CWE-285) and reaches a code-execution path. Per CVSS AV:N/AC:L/PR:N/UI:N, no authentication, privileges, user interaction, or non-default configuration are stated as required - the limiting factor is simply reachability of the FUXA web service, so instances exposed to the internet or a broad OT/IT network are directly at risk while instances isolated behind strict network segmentation are not. Exploitation is confined to the affected version 1.3.2-2809 as stated; applicability to other versions is not established in the available sources.

Signals are consistent and point to genuine high priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity flaw requiring no privileges or user interaction, and the full C:H/I:H/A:H impact reflects the stated outcome of arbitrary code execution - a reasonable score for an unauthenticated-RCE chain against a web-exposed SCADA/HMI application. Cisco Talos (a credible first-party research source) reported it, and the vuln.today decision label is 'act_now', reinforcing urgency. However, several corroborating signals are absent: no EPSS score was provided, the vulnerability is NOT listed in CISA KEV, and no public proof-of-concept or working exploit code is present in the input (the sole reference is the Talos advisory itself, not an exploit). The practical limiter on real-world risk is exposure and footprint, not exploit difficulty: FUXA is a niche open-source industrial process-visualization tool, so impact depends heavily on how many instances are internet- or OT-network-reachable. Net assessment: treat as a real, actionable priority because of the unauthenticated-RCE profile and act_now label, while noting that active exploitation is not confirmed and widespread automated exploitation is not yet evidenced.

An attacker who can reach the FUXA web interface over the network sends a specially crafted, unauthenticated HTTP request to the /nodered functionality, bypassing authorization. Because the exploitation path leads to arbitrary code execution (CVSS AV:N/AC:L/PR:N/UI:N), the attacker can run commands on the host without any credentials or user interaction. No public exploit code is identified in the provided sources, so exploitation currently requires the attacker to develop their own request based on the Talos advisory.