CVE-2026-43945: FUXA SCADA/HMI RCE Vulnerability

CVE-2026-43945 Overview

CVE-2026-43945 is an unauthenticated remote code execution vulnerability in FUXA, a web-based Process Visualization (SCADA/HMI/Dashboard) platform. The flaw affects versions 1.2.11 through 1.3.0 and allows a network-based attacker to execute arbitrary code as root on the underlying host. The exploit succeeds even when FUXA is deployed in its most hardened configuration, with Secure Mode Enabled and Node-RED Secure Auth Enabled. Version 1.3.1 fixes the issue. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can obtain full root-level remote code execution on FUXA hosts operating in industrial and process visualization environments, bypassing existing authentication controls.

Affected Products

FUXA versions 1.2.11 through 1.3.0
Deployments running with Secure Mode Enabled
Deployments running with Node-RED Secure Auth Enabled

Discovery Timeline

2026-07-21 - CVE-2026-43945 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-43945

Vulnerability Analysis

FUXA is an open-source SCADA (Supervisory Control and Data Acquisition), HMI (Human Machine Interface), and dashboard platform used to visualize and interact with industrial processes. The vulnerability allows an unauthenticated, network-based attacker to execute arbitrary code on the server hosting FUXA. Because FUXA typically runs with elevated privileges, the resulting code execution occurs as root. Successful exploitation gives an attacker full control over the visualization host and any operational technology assets it can reach.

The flaw is categorized under CWE-94: Improper Control of Generation of Code, indicating that attacker-supplied input is incorporated into code that the application evaluates or executes. Notably, the exploit path succeeds even when Secure Mode and Node-RED Secure Auth are enabled, meaning documented hardening measures do not prevent the attack.

Root Cause

The root cause is improper control over code generation within FUXA. Attacker-controlled data reaches a code evaluation or execution sink without adequate validation. This design flaw sits in a code path reachable prior to authentication checks, which is why enabling Secure Mode and Node-RED Secure Auth does not mitigate the issue. Full technical details are published in the GitHub Security Advisory GHSA-p69w-mmfv-xrfj.

Attack Vector

Exploitation requires only network reachability to the FUXA web interface. No authentication, user interaction, or prior foothold is needed. An attacker sends a crafted HTTP request to a vulnerable endpoint, causing the server to interpret attacker-supplied payload as executable code. Since FUXA is often deployed on the boundary between IT and OT networks, a successful compromise can pivot into industrial control assets.

See the GitHub Security Advisory GHSA-p69w-mmfv-xrfj for technical exploitation details.

Detection Methods for CVE-2026-43945

Indicators of Compromise

Unexpected outbound network connections initiated by the FUXA process or its Node.js runtime.
New or modified files under FUXA installation directories, or unexpected child processes such as shells spawned by the FUXA service.
HTTP requests to FUXA endpoints containing serialized code, function definitions, or JavaScript payloads from untrusted sources.
Root-owned processes launched by the FUXA service that do not match the documented process tree.

Detection Strategies

Inspect FUXA and Node-RED access logs for anomalous POST requests targeting API or scripting endpoints from unauthenticated clients.
Monitor for the FUXA service invoking interpreters (sh, bash, node, curl, wget) as child processes, which is atypical during normal operation.
Correlate web request patterns with process creation events on the host to identify request-to-execution chains.

Monitoring Recommendations

Enable process execution and command-line auditing on hosts running FUXA and forward events to a centralized analytics platform.
Alert on network egress from FUXA hosts to unexpected destinations, particularly ephemeral cloud infrastructure.
Track version banners exposed by FUXA instances across the environment to identify unpatched deployments running versions 1.2.11 through 1.3.0.

How to Mitigate CVE-2026-43945

Immediate Actions Required

Upgrade FUXA to version 1.3.1 or later, available at the FUXA v1.3.1 release page.
Restrict network access to FUXA web interfaces so they are not reachable from untrusted networks or the public internet.
Audit FUXA hosts for signs of prior exploitation, including unauthorized processes, files, and outbound connections.
Rotate credentials and secrets stored on or accessible from compromised FUXA hosts if evidence of exploitation is found.

Patch Information

The FUXA maintainers released version 1.3.1 to remediate this vulnerability. The patch is available on the FUXA v1.3.1 release page and is described in the GitHub Security Advisory GHSA-p69w-mmfv-xrfj. Enabling Secure Mode or Node-RED Secure Auth alone does not remediate the issue — upgrading is required.

Workarounds

Place FUXA behind a reverse proxy or VPN that enforces strong authentication before requests reach the application.
Segment FUXA hosts on isolated OT/DMZ networks with strict firewall rules limiting inbound and outbound traffic.
Run FUXA as a non-root user where feasible to reduce blast radius, understanding this does not prevent exploitation.
Disable exposure of FUXA to any interface that does not require it until the patch can be applied.

bash

# Configuration example: restrict FUXA access to trusted management subnet
# iptables rules — allow only trusted subnet to reach FUXA on port 1881
iptables -A INPUT -p tcp --dport 1881 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 1881 -j DROP

# Verify upgraded version after patching
cd /opt/FUXA && git describe --tags
# Expected output: v1.3.1 or later