CVE-2026-25894

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25894", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-06T21:08:39.130Z", "datePublished": "2026-02-09T22:28:46.316Z", "dateUpdated": "2026-02-11T21:25:17.858Z"}, "containers": {"cna": {"title": "FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration", "problemTypes": [{"descriptions": [{"cweId": "CWE-321", "lang": "en", "description": "CWE-321: Use of Hard-coded Cryptographic Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-1188", "lang": "en", "description": "CWE-1188: Insecure Default Initialization of Resource", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.5, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg"}, {"name": "https://github.com/frangoteam/FUXA/commit/ea7b3df066f9fdef8ecdce318398ae40546bc50d", "tags": ["x_refsource_MISC"], "url": "https://github.com/frangoteam/FUXA/commit/ea7b3df066f9fdef8ecdce318398ae40546bc50d"}, {"name": "https://github.com/frangoteam/FUXA/releases/tag/v1.2.10", "tags": ["x_refsource_MISC"], "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.2.10"}], "affected": [{"vendor": "frangoteam", "product": "FUXA", "versions": [{"version": "< 1.2.10", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T22:28:46.316Z"}, "descriptions": [{"lang": "en", "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10."}], "source": {"advisory": "GHSA-32cc-x95p-fxcg", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-11T21:25:11.880678Z", "id": "CVE-2026-25894", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T21:25:17.858Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25894", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-11T21:25:11.880678Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-11T21:25:14.999Z"}}], "cna": {"title": "FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration", "source": {"advisory": "GHSA-32cc-x95p-fxcg", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.5, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "frangoteam", "product": "FUXA", "versions": [{"status": "affected", "version": "< 1.2.10"}]}], "references": [{"url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg", "name": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/frangoteam/FUXA/commit/ea7b3df066f9fdef8ecdce318398ae40546bc50d", "name": "https://github.com/frangoteam/FUXA/commit/ea7b3df066f9fdef8ecdce318398ae40546bc50d", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/frangoteam/FUXA/releases/tag/v1.2.10", "name": "https://github.com/frangoteam/FUXA/releases/tag/v1.2.10", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321: Use of Hard-coded Cryptographic Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1188", "description": "CWE-1188: Insecure Default Initialization of Resource"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-09T22:28:46.316Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25894", "state": "PUBLISHED", "dateUpdated": "2026-02-11T21:25:17.858Z", "dateReserved": "2026-02-06T21:08:39.130Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-09T22:28:46.316Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FUXA", "vendor": "frangoteam", "versions": [{"status": "affected", "version": "< 1.2.10"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:frangoteam:fuxa:*:*:*:*:*:*:*:*", "matchCriteriaId": "5811902D-CD7C-4D52-BD99-66EACBBB88FC", "versionEndExcluding": "1.2.10", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An insecure default configuration in FUXA allows an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. This affects FUXA through version 1.2.9 when authentication is enabled, but the administrator JWT secret is not configured. This issue has been patched in FUXA version 1.2.10."}, {"lang": "es", "value": "FUXA es un software de visualizaci\u00f3n de procesos (SCADA/HMI/Dashboard) basado en web. Una configuraci\u00f3n predeterminada insegura en FUXA permite a un atacante remoto no autenticado obtener acceso administrativo y ejecutar c\u00f3digo arbitrario en el servidor. Esto afecta a FUXA hasta la versi\u00f3n 1.2.9 cuando la autenticaci\u00f3n est\u00e1 habilitada, pero el secreto JWT del administrador no est\u00e1 configurado. Este problema ha sido parcheado en la versi\u00f3n 1.2.10 de FUXA."}], "id": "CVE-2026-25894", "lastModified": "2026-06-17T10:25:23.730", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.5, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25894", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-11T21:25:11.880678Z", "version": "2.0.3"}}]}, "published": "2026-02-09T23:16:05.463", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/frangoteam/FUXA/commit/ea7b3df066f9fdef8ecdce318398ae40546bc50d"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/frangoteam/FUXA/releases/tag/v1.2.10"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/frangoteam/FUXA/security/advisories/GHSA-32cc-x95p-fxcg"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}, {"lang": "en", "value": "CWE-1188"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.2.10)"}}], "product": "fuxa", "vendor": "frangoteam"}], "analysis": {"en": {"generated_at": "2026-04-17T21:03:38.010194+00:00", "value": {"mitigation_remediation": ["Upgrade FUXA to version 1.2.10 or later.", "If an upgrade is not immediately possible, configure a strong, unique administrator JWT secret in the FUXA configuration to replace the hard\u2011coded value.", "After changing the configuration, restart the FUXA service to apply the new secret."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "The issue affects FUXA Process Visualization software by Frangoteam. Installations using the default configuration on any version up to and including 1.2.9 are vulnerable. The vulnerability is fixed in version 1.2.10, which requires the administrator to configure a custom JWT secret.", "description_and_impact": "An insecure default configuration in FUXA hardcodes a JSON Web Token (JWT) secret when authentication is enabled but no secret is supplied. This allows an unauthenticated attacker to forge token credentials and impersonate an administrator, leading to arbitrary code execution on the server. The flaw falls under CWE\u20111188 (Generating Cryptographically Strong Secrets Using Weak or Unsuitable Keys) and CWE\u2011321 (Use of Hard\u2011coded Cryptographic Key). The impact is complete loss of confidentiality, integrity, and availability of the affected system.", "risk_and_exploitability": "The CVSS score of 9.5 indicates a critical severity, although the EPSS score of less than 1% indicates the likelihood of exploitation is low. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote and unauthenticated; an attacker can send crafted requests to the FUXA application over the network to exploit the hardcoded secret and gain administrative access."}}}}, "created": "2026-02-10T16:26:48.998383+00:00", "updated": "2026-04-17T21:15:27.375108+00:00", "vendors": ["frangoteam", "frangoteam$PRODUCT$fuxa"]}