CVE-2026-43947 Details
Description
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an unauthenticated Remote Code Execution vulnerability when `secureEnabled` is set to `true`. The `POST /api/runscript` endpoint checks authorization against the stored script's permission by ID, but when `test: true` is set in the request, it compiles and executes attacker-supplied code instead of the stored script's code. An unauthenticated attacker who knows a valid script ID and name may execute arbitrary code via test mode if at least one server-side script exists and is accessible without restrictive permissions. Script IDs and names can be obtained through the unauthenticated information disclosure in `GET /api/project` (reported separately). The only prerequisite is that at least one server-side script exists in the project. Version 1.3.1 fixes the issue.
A remote code execution vulnerability has been identified in FUXA version 1.3.0, a web-based process visualization software, when the 'secureEnabled' setting is true. The vulnerability arises in the 'POST /api/runscript' endpoint, which improperly authorizes script execution. Instead of executing the intended script, the endpoint compiles and runs attacker-supplied code when 'test: true' is included in the request. This flaw allows an unauthenticated attacker to execute arbitrary code if they know a valid script ID and name, and if at least one accessible server-side script exists without restrictive permissions.
Users can upgrade to FUXA version 1.3.1 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 21, 2026CISA-ADP
Assessed Jul 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/frangoteam/FUXA/commit/78534da61a91613712b44bb63c8d7da8c5df5ca4 | [email protected] | Source CodeVendor |
| https://github.com/frangoteam/FUXA/pull/2260 | [email protected] | Issue TrackingVendor |
| https://github.com/frangoteam/FUXA/releases/tag/v1.3.1 | [email protected] | Release NotesVendor |
| https://github.com/frangoteam/FUXA/security/advisories/GHSA-rg3m-cfq7-g6h6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| FUXA | 1.3.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 23, 2026 | CVE Modified | CISA-ADP |
| Jul 21, 2026 | New CVE Received | [email protected] |