CVE-2025-69970

—

CVSS 3.1

9.3 critical

EPSS

<1%p39

Published

Feb 3, 2026 (Feb 3, 2026)

Modified

Jun 17, 2026

Description

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

Vendors: frangoteam
Products: fuxa
Weakness: CWE-1188
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.