CVE-2026-25939: Frangoteam FUXA Auth Bypass Vulnerability

CVE-2026-25939 Overview

CVE-2026-25939 is an authorization bypass vulnerability in FUXA, a web-based Process Visualization (SCADA/HMI/Dashboard) platform developed by frangoteam. The flaw affects FUXA versions 1.2.8 through 1.2.10 and allows an unauthenticated, remote attacker to create and modify arbitrary schedulers. Because FUXA orchestrates industrial control system (ICS) and SCADA workflows, scheduler manipulation can drive follow-on actions against connected operational technology environments. The issue is classified as a Missing Authorization weakness [CWE-862] and was patched in FUXA 1.2.11.

Critical Impact

Unauthenticated attackers can reach scheduler endpoints over the network and manipulate automation logic in connected ICS/SCADA deployments without any user interaction.

Affected Products

• frangoteam FUXA 1.2.8
• frangoteam FUXA 1.2.9
• frangoteam FUXA 1.2.10

Discovery Timeline

• 2026-02-09 - CVE-2026-25939 published to NVD
• 2026-02-13 - Last updated in NVD database

Technical Details for CVE-2026-25939

Vulnerability Analysis

The vulnerability resides in FUXA's scheduler functionality. FUXA exposes server-side endpoints used to define and update scheduled tasks that interact with SCADA tags, devices, and HMI logic. In versions 1.2.8 through 1.2.10, those endpoints do not enforce authentication or authorization checks before accepting create and modify operations. As a result, any network-reachable client can invoke them.

FUXA is commonly deployed at the edge of ICS networks to bridge field devices with operator interfaces. Scheduler abuse in that context can trigger device writes, change setpoints, or execute automation sequences. The CWE-862 classification reflects the absence of an access control layer in the affected request handlers.

Root Cause

The root cause is missing authorization on the scheduler API routes. The application accepts scheduler create and update requests without verifying a valid authenticated session, role, or token. The upstream fix in commit 5782b35117a9bd14ffcb881f8dfb8c6680157d9b adds the required authorization checks before scheduler state is mutated.

Attack Vector

The attack vector is network-based and requires no privileges and no user interaction. An attacker with HTTP reachability to the FUXA web server can issue crafted requests directly to the scheduler endpoints. In ICS environments where FUXA is exposed to engineering VLANs or, in misconfigured deployments, directly to the internet, the exposure is immediate.

No verified proof-of-concept code has been published. Technical details are described in the GitHub Security Advisory GHSA-c869-jx4c-q5fc and the patch commit.

Detection Methods for CVE-2026-25939

Indicators of Compromise

• Unexpected scheduler entries appearing in FUXA configuration that were not created by known operators or engineering workstations.
• HTTP requests to FUXA scheduler API endpoints originating from IP addresses outside the engineering management subnet.
• Modifications to scheduler timing, target tags, or actions without a corresponding change-control record.

Detection Strategies

• Monitor FUXA web server access logs for POST and PUT requests targeting scheduler routes, correlating against authenticated session identifiers.
• Alert on scheduler configuration changes that occur outside maintenance windows or from non-allowlisted source IPs.
• Compare running FUXA scheduler configuration against a known-good baseline on a recurring schedule.

Monitoring Recommendations

• Forward FUXA application and web server logs to a centralized log platform with retention sufficient for ICS incident response.
• Capture north-south and east-west network flows to the FUXA host, focusing on HTTP/HTTPS sessions from non-operator endpoints.
• Track outbound writes from FUXA to PLCs and field devices to identify scheduler-driven anomalies in process values.

How to Mitigate CVE-2026-25939

Immediate Actions Required

• Upgrade FUXA to version 1.2.11 or later, which contains the authorization fix in commit 5782b35117a9bd14ffcb881f8dfb8c6680157d9b.
• Audit existing scheduler entries on all FUXA instances running 1.2.8 through 1.2.10 and remove any unauthorized definitions.
• Restrict network access to the FUXA web interface so that only operator and engineering workstations can reach it.

Patch Information

The vendor released the fix in FUXA v1.2.11. The change adds authorization enforcement on scheduler endpoints, as documented in the vendor security advisory.

Workarounds

• Place the FUXA server behind a reverse proxy that enforces authentication before requests reach the application.
• Apply firewall rules that limit inbound access to the FUXA HTTP port to a defined allowlist of engineering hosts.
• Segment FUXA into a dedicated ICS DMZ and block all direct internet exposure until the patch is applied.

# Example: restrict access to FUXA web port (default 1881) using iptables
iptables -A INPUT -p tcp --dport 1881 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1881 -j DROP