CVE-2025-69985: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69985 is an authentication bypass vulnerability in FUXA, an open-source SCADA/HMI web application developed by frangoteam, that leads to unauthenticated Remote Code Execution (RCE). The vulnerability affects FUXA versions 1.2.8 and prior and resides in the server/api/jwt-helper.js middleware, which improperly trusts the HTTP Referer header to validate internal requests. A remote unauthenticated attacker can spoof the Referer header to bypass JWT authentication and access the /api/runscript endpoint to execute arbitrary Node.js code. It was published on February 24, 2026, and carries a CVSS v3.1 base score of 9.8 (Critical) (Feedly, GitHub PoC).

The root cause is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The requireAuth middleware in jwt-helper.js contains logic that whitelists requests whose Referer header contains /fuxa, treating them as trusted internal requests and bypassing JWT token validation entirely. This is described as an incomplete fix for the prior CVE-2023-33831. An attacker simply crafts an HTTP POST request to /api/runscript with the Referer header set to http://<target>:1881/fuxa, which causes the middleware to skip authentication and pass the request through. The test property of the submitted script object is then executed as arbitrary Node.js code on the server, leveraging Node.js built-ins such as child_process (GitHub PoC, FUXA Source).

Successful exploitation grants a remote unauthenticated attacker full control over the FUXA server, with high impact to confidentiality, integrity, and availability. The attacker can execute arbitrary Node.js code, enabling actions such as spawning reverse shells, exfiltrating sensitive SCADA/HMI configuration data, overwriting the user database (users.fuxap.db) to perform admin account takeover, and potentially disrupting industrial control system operations. Given FUXA's role as a SCADA/HMI platform, exploitation could have downstream consequences for operational technology (OT) environments (Feedly, GitHub PoC).

Multiple public proof-of-concept exploits are available, including a Python-based PoC on GitHub Gist demonstrating RCE via calc.exe launch and admin database overwrite, a dedicated GitHub repository by joshuavanderpoll, and an entry on Exploit-DB (EDB-52544). As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and no threat actor attribution has been made. The EPSS score is approximately 0.64%, and the vulnerability has not been added to the CISA KEV catalog. No vendor patch is currently available (GitHub PoC, GitHub Repo, Exploit-DB, Feedly).

1. Reconnaissance: Identify internet-facing or network-accessible FUXA instances (default port 1881) using tools like Shodan, Censys, or nmap. Confirm the version is 1.2.8 or earlier.
2. Confirm target endpoint: Verify the /api/runscript endpoint is accessible by sending a basic HTTP request to http://<target>:1881/api/runscript.
3. Craft the bypass request: Construct an HTTP POST request to http://<target>:1881/api/runscript with the Content-Type: application/json header and, critically, set the Referer header to http://<target>:1881/fuxa to spoof an internal request and bypass requireAuth middleware.
4. Inject Node.js payload: Include a JSON body with the malicious Node.js code in the params.script.test field. Example payload for RCE:

{
  "params": {
    "script": {
      "parameters": [],
      "mode": "",
      "id": "rce",
      "name": "rce",
      "code": "require('child_process').exec('id', (e,s)=>{ return s; })",
      "test": "require('child_process').exec('id', (e,s)=>{ return s; })"
    },
    "toLogEvent": false
  }
}

5. Achieve code execution: The server executes the injected Node.js code in the FUXA process context, returning output or performing actions (e.g., reverse shell, file write, database overwrite).
6. Escalate access (optional): Use the RCE to overwrite _appdata/users.fuxap.db with a crafted SQLite database containing a known admin password hash, then authenticate as admin after a server restart (GitHub PoC, GitHub Repo).

• Network: Unexpected HTTP POST requests to /api/runscript on port 1881 from external or untrusted IP addresses; requests containing a Referer header with /fuxa path from non-browser or non-internal sources; outbound connections from the FUXA server process to unknown external IPs (indicative of reverse shell activity).
• Logs: FUXA access logs showing POST requests to /api/runscript without a valid x-access-token header but with a spoofed Referer header; Node.js error or execution logs showing unexpected script execution events.
• File System: Unexpected modification or replacement of _appdata/users.fuxap.db (SQLite user database); new or modified files in the FUXA installation directory created by the Node.js process; presence of web shells or scripts dropped via fs.writeFileSync.
• Process: Unusual child processes spawned by the FUXA Node.js process (e.g., cmd.exe, /bin/bash, powershell.exe, curl, wget, nc); unexpected network listeners created by child processes of the FUXA service (GitHub PoC).

No official vendor patch is currently available for CVE-2025-69985. Until a fix is released, the following mitigations are recommended: (1) Restrict network access to FUXA servers and the /api/runscript endpoint using firewall rules or network segmentation, ensuring FUXA is not exposed to the internet; (2) Deploy WAF rules to block or alert on POST requests to /api/runscript that contain a Referer header with /fuxa from untrusted sources; (3) Disable or remove the /api/runscript endpoint if script execution is not required for operations; (4) Monitor FUXA access logs for suspicious requests to the endpoint; (5) Apply the principle of least privilege to the FUXA service account to limit the impact of code execution. Monitor the official FUXA GitHub repository and Red Hat CVE advisory for patch availability (Feedly, FUXA Source).

The vulnerability received attention on LinkedIn, with multiple posts discussing the authentication bypass and RCE impact (LinkedIn Post 1, LinkedIn Post 2). The Mastodon security community also noted the Exploit-DB publication. Threat intelligence platforms including Radar by Offseq and VulDB catalogued the vulnerability shortly after disclosure. The availability of multiple public PoC exploits and the critical CVSS score have driven moderate community concern, particularly given FUXA's use in industrial SCADA/HMI environments.