CVE-2026-25951
📋 TL;DR
CVE-2026-25951 is a path traversal vulnerability in FUXA web-based SCADA/HMI software that allows authenticated administrators to bypass directory protections using nested traversal sequences. This enables arbitrary file writes to sensitive directories, leading to remote code execution when malicious scripts are reloaded. Only FUXA installations before version 1.2.11 with administrative accounts are affected.
💻 Affected Systems
- FUXA
📦 What is this software?
Fuxa by Frangoteam
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, allowing attackers to execute arbitrary commands, steal sensitive data, disrupt industrial processes, and pivot to other systems.
Likely Case
Attackers with administrative credentials write malicious scripts to gain persistent access, modify configurations, and potentially disrupt SCADA/HMI operations.
If Mitigated
With proper access controls and network segmentation, impact is limited to the FUXA application instance without affecting broader industrial control systems.
🎯 Exploit Status
Exploitation requires administrative credentials but uses simple path traversal techniques; GitHub advisory provides technical details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.2.11
Vendor Advisory: https://github.com/frangoteam/FUXA/security/advisories/GHSA-68m5-5w2h-h837
Restart Required: Yes
Instructions:
1. Backup current FUXA configuration and data. 2. Download FUXA v1.2.11 from GitHub releases. 3. Stop the FUXA service. 4. Replace existing installation with v1.2.11. 5. Restart FUXA service. 6. Verify functionality.
🔧 Temporary Workarounds
Restrict Administrative Access
allLimit administrative account usage and implement strong authentication controls
Network Segmentation
allIsolate FUXA instances from critical systems and restrict network access
🧯 If You Can't Patch
- Implement strict access controls and multi-factor authentication for administrative accounts
- Monitor file system writes to runtime/scripts directory and alert on suspicious patterns
🔍 How to Verify
Check if Vulnerable:
Check FUXA version via web interface or configuration files; versions below 1.2.11 are vulnerableCheck Version:
Check FUXA web interface or examine package.json/version files in installation directoryVerify Fix Applied:
Confirm FUXA version is 1.2.11 or higher and test path traversal attempts are properly blocked📡 Detection & Monitoring
Log Indicators:
- Unusual file write patterns to runtime/scripts directory
- Multiple failed path traversal attempts followed by successful writes
- Administrative account activity from unexpected sources
Network Indicators:
- HTTP requests containing nested traversal sequences (....//)
- Unusual outbound connections from FUXA server
SIEM Query:
source="fuxa" AND (uri="*....//*" OR event="file_write" AND path="*/runtime/scripts/*")