EUVD-2026-61212Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote and unauthenticated via a self-minted guest token (AV:N/PR:N), but requires a specific non-default Node-RED secure configuration, modeled as AC:H; runtime code execution yields full C:H/I:H/A:H.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity. When nodeRedEnabled is true, secureEnabled is true, and nodeRedAuthMode is secure, a remote unauthenticated attacker can obtain a signed guest token from POST /api/heartbeat and use it to access the RED.httpAdmin editor and flow deployment API. Because the Node-RED configuration has no second adminAuth gate, the attacker can deploy function nodes or invoke fuxa.runScript and runtime.scriptsMgr.runScript, gaining control of FUXA project data, configuration, scripts, filesystem-capable runtime helpers, and potentially operating-system commands when nodeRedUnsafeModules is enabled. This issue is fixed in version 1.3.3.
AnalysisAI
Authorization bypass in FUXA (a web-based SCADA/HMI/dashboard platform) versions 1.3.2 and earlier lets a remote unauthenticated attacker escalate to full runtime control when the Node-RED integration is enabled in secure mode. The allowDashboard gate in server/integrations/node-red/index.js verifies a JWT's signature but never inspects the decoded identity, so a low-privilege guest token that anyone can mint from POST /api/heartbeat is accepted for the privileged Node-RED editor and flow-deployment API. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only when the FUXA server is configured with nodeRedEnabled=true, secureEnabled=true, and nodeRedAuthMode=secure - this exact combination exposes the /nodered editor guarded by the flawed allowDashboard gate. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue where the affected feature is configured, not merely a high-CVSS paper cut. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to FUXA 1.3.3, which adds identity-aware authorization (verifyAndDecode plus createNodeRedAuthMiddleware) that rejects guest and identity-less tokens on the /nodered editor and deployment routes (release https://github.com/frangoteam/FUXA/releases/tag/v1.3.3). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit FUXA deployments to identify instances with Node-RED integration enabled and immediately implement network-level access controls to restrict the Node-RED editor and flow-deployment APIs; disable Node-RED if not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today