Executive brief
FUXA is an open-source software platform used to build industrial automation dashboards and control systems. In version 1.2.7 and earlier, authentication is disabled by default in the configuration file, allowing anyone with network access to the application to immediately gain full control of the system, including the ability to modify projects and send commands to connected industrial equipment without any password or credential verification.
Technical details
The vulnerability exists in server/settings.default.js, where the 'secureEnabled' flag is commented out, causing the application to initialize with authentication disabled (CWE-1188: insecure default, CWE-306: missing authentication). The root cause is improper default configuration that leaves a security-critical flag disabled. An unauthenticated attacker on the network can access the application immediately after installation without any preconditions, gaining the ability to call sensitive API endpoints, modify projects, and control connected industrial equipment. The vulnerable versions extend from 0 through at least 1.2.7. Patch or configuration fix availability is not specified in the advisory.
Affected products
- FUXA FUXA up to and including 1.2.7
Timeline
- 2026-02-03: disclosed
- 2026-02-04: advisory: GitHub advisory GHSA-r5m2-fqcf-qrf7 published