Authorization Bypass in FUXA Web-based Process Visualization Software
CVE-2026-25752

9.3CRITICAL

Key Information:

Vendor

Frangoteam

Status
Fuxa
Vendor
CVE Published:
6 February 2026

What is CVE-2026-25752?

FUXA, a web-based Process Visualization software, is susceptible to an authorization bypass vulnerability that allows unauthenticated remote attackers to manipulate device tags through WebSockets. By exploiting this weakness, attackers can circumvent role-based access controls, potentially enabling them to overwrite device tags or disable communication drivers. This exposes ICS/SCADA environments to further threats, including the potential manipulation of physical processes and disruption of connected devices. The vulnerability affects FUXA versions up to 1.2.9 and has been addressed in version 1.2.10.

Affected Version(s)

FUXA < 1.2.10

References

https://github.com/frangoteam/FUXA/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/frangoteam/FUXA/releases/tag/v1.2.10
x_refsource_MISC

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.