CVE-2025-69970: XSS
FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-69970?
CVE-2025-69970 is classified as a high severity vulnerability due to its potential to allow unauthorized access to sensitive API endpoints.
How do I fix CVE-2025-69970?
To fix CVE-2025-69970, enable the 'secureEnabled' flag in the server/settings.default.js configuration file by uncommenting it.
Which versions of FUXA are affected by CVE-2025-69970?
FUXA version 1.2.7 is affected by CVE-2025-69970, as it contains the insecure default configuration.
What are the impacts of CVE-2025-69970?
CVE-2025-69970 allows unauthenticated remote attackers to access sensitive API endpoints, potentially leading to data breaches.
Is there a known exploit for CVE-2025-69970?
There are no publicly disclosed exploits associated with CVE-2025-69970, but the vulnerability can be easily exploited due to its nature.