CVE-2026-25751: FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software

Q: How do I fix CVE-2026-25751?

fuxa: upgrade to 1.2.10. Exact commands for each OS are on this page.

Q: Is CVE-2026-25751 being exploited?

CVE-2026-25751 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2026-25751 affect?

CVE-2026-25751 affects fuxa. Severity is high (CVSS 7.5). FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation all

Q: How urgent is CVE-2026-25751?

Priority 37/100. High severity; Remotely exploitable, no login, no user action

Routine

HIGH 7.5REMOTEUPGRADE

CVE-2026-25751 is a high-severity flaw (CVSS 7.5) affecting fuxa. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenti

Why this priority

High severity
Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score	7.5 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	0.3% (top 77%)
CISA exploited list	No
Weakness	CWE-306, CWE-312
Published	2026-02-06
Last modified	2026-06-17

Publisher (CNA): GitHub, Inc. · Vendor: frangoteam

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2026-02-06 19:16 UTCPublished CVE record published
2026-06-17 10:25 UTCUpdated Record last modified

frangoteam fuxa UPGRADE

Affected: < 1.2.10

Fixed in: 1.2.10

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy fuxa || rpm -q fuxa || fuxa --version

2. UPGRADE to 1.2.10 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade fuxa

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade fuxa

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2026-25751?

fuxa: upgrade to 1.2.10. Exact commands for each OS are on this page.

Is CVE-2026-25751 being exploited?

CVE-2026-25751 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2026-25751 affect?

CVE-2026-25751 affects fuxa. Severity is high (CVSS 7.5). FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation all

How urgent is CVE-2026-25751?

Priority 37/100. High severity; Remotely exploitable, no login, no user action

Related CVEs

CVE-2026-25752 CRITICAL 9.1 UPGRADE FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software
CVE-2025-69985 CRITICAL 9.8 UPGRADE FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE)
CVE-2025-69983 CRITICAL 9.8 DOWNGRADE FUXA v1.2.7 allows Remote Code Execution (RCE) via the project import functionality
CVE-2025-69981 CRITICAL 9.8 DOWNGRADE FUXA v1.2.7 contains an Unrestricted File Upload vulnerability in the `/api/upload` API endpoint
CVE-2025-69971 CRITICAL 9.8 DOWNGRADE FUXA v1.2.7 contains a hard-coded credential vulnerability in server/api/jwt-helper.js

References

← Back to latest CVEs