CVE-2026-43946highCWE-863

CVE-2026-43946: falha de alta gravidade em frangoteam FUXA

FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar FUXA+ Monitorar fuxa-server

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.7epss 0.6%
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Version 1.3.0 has an authorization bypass in the /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Version 1.3.1 patches the issue.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Produtos afetados
frangoteam · FUXA
CVEs relacionadas — frangoteam FUXA

No mesmo produto, das mais perigosas para as menos.

CVE-2026-25895CRITICALFUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload APIEPSS 13.0%CVE-2026-25939CRITICALFUXA Unauthenticated Remote Arbitrary Scheduler WriteEPSS 12.7%CVE-2026-25951HIGHFUXA has a Path Traversal Sanitization BypassEPSS 1.4%CVE-2026-47717HIGHFUXA's Unauthenticated Project Data Disclosure Exposes Server-Side Scripts and Device ConfigurationsEPSS 1.4%CVE-2026-25938CRITICALFUXA Unauthenticated Remote Code Execution in Node-RED IntegrationEPSS 1.1%CVE-2026-43947HIGHFUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization BypassEPSS 0.9%