Unauthenticated arbitrary file write enables takeover of FUXA SCADA/HMI servers (CVE-2026-25895)
VulnCheck's canary sensors have recorded exploitation attempts on multiple consecutive days this week with public exploit code available, so any internet-reachable FUXA instance still on 1.2.9 or earlier is likely to be compromised imminently.
A path traversal flaw in the FUXA web-based SCADA/HMI software lets an unauthenticated remote attacker write arbitrary files to arbitrary locations on the server filesystem, which readily translates to code execution on the host controlling industrial visualization and dashboards.
Affected: frangoteam FUXA through 1.2.9 (fixed in 1.2.10)
How to Test
Check the running FUXA version in the web UI or package.json; anything below 1.2.10 is vulnerable. Review web server logs for upload/API requests containing '../' path traversal sequences and inspect the filesystem for recently created unexpected files (webshells, cron entries, modified startup scripts).
How to Patch
Upgrade to FUXA 1.2.10 (commit 22c2192 contains the fix). If you cannot upgrade today, remove direct internet exposure of the FUXA web interface and restrict access to a VPN or allow-listed operator network.