CVE-2026-25752 is an authorization bypass in FUXA, the web based SCADA and HMI software, rated 9.1. An unauthenticated remote attacker can use WebSockets to overwrite device tags or disable communication drivers. Versions through 1.2.9 are affected, and 1.2.10 fixes it.
What's affected
- Product: FUXA, a web based process visualisation (SCADA, HMI, dashboard) tool, published on npm as fuxa-server.
- Affected: versions through 1.2.9.
- Fixed: 1.2.10.
- Scope: all deployments, including those with secureEnabled set to true, according to the advisory.
How to check if you're exposed
Check the running version and who can reach the service:
npm ls fuxa-server
docker ps --format '{{.Image}}' | grep -i fuxa
Then check from a separate network segment whether the FUXA port answers. A SCADA front end should not be reachable from the internet or from general office networks.
What to do now
- Upgrade to FUXA 1.2.10 or later.
- Remove any internet exposure of FUXA now. Place it behind a VPN or a segmented management network.
- Compare current device tag values and driver states against your known good configuration.
- Review connection logs for WebSocket clients you do not recognise.
- Coordinate with your process engineers before restarting anything connected to live equipment.
Why it matters
The class is CWE-862, missing authorization. The WebSocket path that writes tags did not apply the role checks that protect the normal interface, so enabling authentication did not help.
FUXA sits next to physical equipment. The advisory warns that overwriting tags or disabling drivers could manipulate physical processes or disconnect devices from the HMI. That moves the consequence from data loss to operations. FUXA has several CVEs fixed in the same release (see CVE-2026-25893, CVE-2026-25894 and CVE-2026-25895), so one upgrade closes all of them. The record does not mark this CVE as exploited in the wild.
How to prioritise the fix
Before anything else, check network exposure. A FUXA instance on the public internet is the worst case, and the fix for that is immediate: take it off. After that, schedule the upgrade with the people who run the process, because restarting an HMI can affect what operators see.
The advisory lists overwritten tags and disabled drivers as the outcome. After patching, compare current tag values and driver states with a known good export so you do not carry forward bad state. Because this release also fixes CVE-2026-25893, CVE-2026-25894 and CVE-2026-25895, one upgrade closes several critical issues at once.
Quick check
I enabled authentication. Am I safe?
Not for this bug. The advisory says it affects deployments with secureEnabled true as well, so upgrade to 1.2.10.
Sources
Last reviewed: 19 October 2026.
