FUXA contains an insecure default configuration vulnerability

GHSA-r5m2-fqcf-qrf7 · CVE-2025-69970

Published Feb 3, 2026 · Modified Feb 10, 2026

Description

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2025-69970
PACKAGE https://github.com/frangoteam/FUXA/blob
WEB https://github.com/frangoteam/FUXA/blob/master/server/settings.default.js

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes