FUXA SCADA/HMI Missing Auth and Path Traversal Allow Unauthenticated RCE
Missing authentication and path traversal in FUXA SCADA/HMI software (≤ 1.2.9) let unauthenticated attackers write arbitrary files—including the application itself—enabling remote code execution on OT systems.
- Vendor
- frangoteam
- Product
- FUXA (≤ 1.2.9)
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- exploited-in-wild
- Published
FUXA is an open-source web-based SCADA and HMI platform designed for operational technology and industrial automation. Versions 1.2.9 and below have two compounding flaws: a missing authentication check on a critical function, and a path traversal vulnerability. Together they allow unauthenticated remote attackers to write arbitrary files to the host filesystem.
In FUXA deployments the write-accessible paths include the application’s own main.js. Code written there executes as part of the FUXA process on startup — achieving persistent remote code execution without any authenticated access.
VulnCheck confirmed active scanning against exposed FUXA instances beginning August 18, 2026. Approximately 60 FUXA instances are reachable from the public internet. For a SCADA/HMI platform sitting between network infrastructure and physical control systems, the impact of arbitrary code execution differs materially from the same flaw in a general-purpose web application.
Affected versions: FUXA ≤ 1.2.9
Fixed in: See upstream advisory
What to do:
- If your FUXA instance is internet-reachable, remove that exposure before addressing the patch question. Network segmentation is the faster mitigation.
- Apply the patch per the upstream advisory once available.
- Review firewall rules and VPN requirements for any FUXA deployment on OT networks.
References:
