FUXA - Authorization Bypass

criticalseverity

9.1CVSS score

24.3%likelihood of exploitation, next 30 days

98%of all CVEs are less likely

Readycheck to confirm it

FUXA 1.2.8 through 1.2.10 contains an authorization bypass caused by improper access control in scheduler management, letting unauthenticated remote attackers create and modify schedulers, exploit requires no authentication.

Impact

Unauthenticated attackers can create and modify schedulers, potentially compromising connected ICS/SCADA environments.

Fix

Upgrade to version 1.2.11 or later.

How to confirm it

Send: GET /api/settings
Positive when: status_code == 200 and contains_all(body, "\"secureEnabled\":true", "FUXA")
Send: POST /api/scheduler
Positive when: status_code == 400 and contains(body, "\"error\":\"Missing scheduler id or data in request body\"")

Run it with nuclei: nuclei -id CVE-2026-25939 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2026-25939

info:
  name: FUXA - Authorization Bypass
  author: theamanrawat
  severity: critical
  description: |
    FUXA 1.2.8 through 1.2.10 contains an authorization bypass caused by improper access control in scheduler management, letting unauthenticated remote attackers create and modify schedulers, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can create and modify schedulers, potentially compromising connected ICS/SCADA environments.
  remediation: |
    Upgrade to version 1.2.11 or later.
  reference:
    - https://github.com/frangoteam/FUXA/security/advisories/GHSA-c869-jx4c-q5fc
    - https://github.com/frangoteam/FUXA/commit/5782b35117a9bd14ffcb881f8dfb8c6680157d9b
    - https://nvd.nist.gov/vuln/detail/CVE-2026-25939
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
    cvss-score: 9.1
    cve-id: CVE-2026-25939
    epss-score: 0.12536
    epss-percentile: 0.96266
    cwe-id: CWE-862
  metadata:
    max-request: 2
    vendor: frangoteam
    product: fuxa
    shodan-query: 'http.title:"FUXA"'
    fofa-query: 'title="FUXA"'
  tags: cve,cve2026,fuxa,auth-bypass,scada,ics,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /api/settings HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"secureEnabled\":true", "FUXA")'
        condition: and
        internal: true

  - raw:
      - |
        POST /api/scheduler HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 400'
          - 'contains(body, "\"error\":\"Missing scheduler id or data in request body\"")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from