CVE-2026-25751: FUXA Unauthenticated Exposure of Plaintext Database Credentials
Description An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
Impact This affects all deployments, including those with runtime.settings.secureEnabled set to true.
Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database.
Patches This issue has been patched in FUXA version 1.2.10. Users are strongly encouraged to update to the latest available release.
Other sources
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. An information disclosure vulnerability in FUXA allows an unauthenticated, remote attacker to retrieve sensitive administrative database credentials. Exploitation allows an unauthenticated, remote attacker to obtain the full system configuration, including administrative credentials for the InfluxDB database. Possession of these credentials may allow an attacker to authenticate directly to the database service, enabling them to read, modify, or delete all historical process data, or perform a Denial of Service by corrupting the database. This affects FUXA through version 1.2.9. This issue has been patched in FUXA version 1.2.10.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25751?
CVE-2026-25751 has a high severity rating due to its potential to expose sensitive database credentials.
How do I fix CVE-2026-25751?
To fix CVE-2026-25751, upgrade to FUXA version 1.2.10 or later.
What version of FUXA is affected by CVE-2026-25751?
CVE-2026-25751 affects all versions of FUXA up to and including version 1.2.9.
Can CVE-2026-25751 be exploited remotely?
Yes, CVE-2026-25751 can be exploited by unauthenticated remote attackers.
What type of information is exposed by CVE-2026-25751?
CVE-2026-25751 exposes sensitive administrative database credentials.