VulnerabilityAnalyzed

CVE-2025-69970

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js.

CRITICAL 9.3EPSS 0.47%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.47%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

CVSS 3.1: 9.3 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS: 0.47% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-1188
Affected: frangoteam/fuxa
Source: cve@mitre.org

References

https://github.com/frangoteam/FUXA/blob/master/server/settings.default.jsProduct

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.