Executive brief
FUXA is web-based industrial control system software (SCADA/HMI/Dashboard) used to visualize and manage process data. In versions 1.3.2 and earlier, when Node-RED integration is enabled with security features, an unauthenticated attacker can bypass authorization checks and gain full access to deploy malicious flows, execute arbitrary scripts, and potentially run operating system commands, leading to complete compromise of the FUXA system and any connected industrial processes.
Technical details
The vulnerability is an authentication bypass in the allowDashboard authorization gate for the /nodered endpoint in server/integrations/node-red/index.js. The authJwt.verify function validates JWT signatures but does not inspect the decoded token's identity claims. An attacker can obtain a signed guest token from the unauthenticated POST /api/heartbeat endpoint and reuse it to access the Node-RED RED.httpAdmin editor and flow deployment API. When nodeRedEnabled, secureEnabled, and nodeRedAuthMode=secure are all true, the missing second-layer authorization allows the attacker to deploy function nodes and invoke fuxa.runScript and runtime.scriptsMgr.runScript without further authentication. If nodeRedUnsafeModules is enabled, the attacker can execute arbitrary operating system commands. The fix was released in version 1.3.3.
Affected products
- FUXA Team FUXA 1.3.2 and earlier
Timeline
- 2026-08-18: disclosed
- 2026-06-14: patched: Fix released in version 1.3.3