← Back

CVE-2025-69970

nvd nist
Published: Feb 3, 2026Modified: Jun 17, 2026

JSON object

Loading...
9.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Exploitability: 2.8 / Impact: 5.8
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

Affected (1)

Products: Frangoteam: Fuxa
Frangoteam
1 product
Fuxa
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Fuxa
Version 1.2.7

Related CWEs

CWE-1188
Initialization of a Resource with an Insecure Default
The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.

References (1)

Source: cve@mitre.org
Product

Timeline

No history available yet.