IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-02-03 18:16

MODIFIED

2026-02-03 18:16

EPSS (Prob. Exploit)

0.52%

Top 55.8%

DATA SOURCES:

NVD 🔗 2026-02-03 FIRST EPSS 🔗 2026-11-08 GITHUB 🔗 2026-11-04 OSV 🔗 2026-11-08

> DESCRIPTION

FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> GITHUB SECURITY ADVISORY

GHSA-r5m2-fqcf-qrf7 HIGH

FUXA contains an insecure default configuration vulnerability

AFFECTED PACKAGES:

NPM / fuxa-server

<= 1.2.7

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

AFFECTED PACKAGES:

Unknown / Unknown

2 versions affected

ALIASES:

GHSA-r5m2-fqcf-qrf7

> HISTORIQUE DES MODIFICATIONS

Première apparition

03/02/2026 18:16

Source: NVD

Total des modifications: 0 Dernière mise à jour: 9 months ago

> REFERENCES

https://github.com/frangoteam/FUXA/blob/master/server/settings.default.js