CVE-2026-25893: 
JavaScript vulnerability analysis and mitigation

CVE-2026-25893 is an authentication bypass vulnerability in FUXA, a web-based Process Visualization (SCADA/HMI/Dashboard) software developed by frangoteam. The flaw resides in the heartbeat refresh API, which can be exploited by an unauthenticated, remote attacker to gain administrative access and execute arbitrary code on the server. All FUXA versions prior to 1.2.10 are affected. The vulnerability was published on February 9, 2026, and patched in FUXA version 1.2.10 released January 25, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 10.0 (Critical) (Feedly, FUXA Advisory).

The vulnerability is classified under CWE-285 (Improper Authorization) and CWE-287 (Improper Authentication), reflecting a failure to properly validate the identity of callers to the heartbeat refresh API endpoint (Feedly). The heartbeat refresh API, intended for session keep-alive functionality, does not enforce proper authentication checks, allowing an unauthenticated attacker to interact with it and obtain or mint administrative-level tokens. This results in a fail-open security posture where the application may appear to be operating in a secured mode while still granting elevated access to unauthenticated requests. The patch commit fe82348d160904d0013b9a3e267d50158f5c7afb addresses this specific bypass in the heartbeat token refresh flow (FUXA Release, FUXA Advisory).

Successful exploitation grants an unauthenticated remote attacker full administrative access to the FUXA instance, enabling arbitrary code execution in the context of the FUXA service process. This results in complete compromise of confidentiality, integrity, and availability of the affected server. Given FUXA's role as SCADA/HMI software, exploitation could further expose connected industrial control systems (ICS) and operational technology (OT) environments to follow-on attacks, including manipulation of industrial processes, data exfiltration, or disruption of critical infrastructure operations (Feedly, FUXA Advisory).

As of the time of reporting, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Feedly). The vulnerability is remotely exploitable over the network with no privileges required and no user interaction needed, making it highly automatable. The EPSS score is approximately 0.305%, indicating a currently low but non-negligible probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A technical write-up describing the attack as "Unauthenticated Remote Code Execution via Admin JWT Minting" has been published (Infinitsec).

1. Reconnaissance: Identify internet-facing or network-accessible FUXA instances running versions prior to 1.2.10 using tools such as Shodan or Censys, searching for the FUXA web interface (default port 1881).
2. Identify the heartbeat refresh API: Locate the unauthenticated heartbeat refresh API endpoint exposed by the FUXA server, which is intended for session keep-alive but lacks proper authentication enforcement.
3. Bypass authentication via heartbeat API: Send a crafted unauthenticated HTTP request to the heartbeat refresh API endpoint. Due to improper authorization checks (CWE-285/CWE-287), the server processes the request and issues or refreshes an administrative-level JWT token without verifying the caller's identity.
4. Obtain administrative JWT: Extract the administrative JWT token returned or minted by the server as a result of the malformed heartbeat request.
5. Access administrative APIs: Use the forged or obtained administrative JWT to authenticate against FUXA's administrative API endpoints, gaining full control over the FUXA instance.
6. Execute arbitrary code: Leverage FUXA's administrative features — including automation, scripting, and device interaction capabilities — to execute arbitrary commands on the underlying server, potentially leading to full system compromise and lateral movement into connected ICS/SCADA environments (Feedly, Infinitsec).

• Network: Unexpected or anomalous HTTP requests to the FUXA heartbeat refresh API endpoint from unauthenticated or unknown source IPs; outbound connections from the FUXA server to unknown external hosts following such requests.
• Logs: FUXA server access logs showing repeated unauthenticated requests to the heartbeat/token refresh endpoint; JWT tokens issued without a corresponding valid login event in authentication logs.
• Process: Unusual child processes spawned by the FUXA Node.js server process (e.g., sh, bash, cmd.exe, curl, wget, python) that are not part of normal FUXA operation.
• File System: Unexpected new files, scripts, or web shells written to the FUXA installation directory or system directories; modifications to FUXA configuration files (userSettings.json) by non-administrative processes.

The primary remediation is to upgrade FUXA to version 1.2.10 or later, which patches the authentication bypass in the heartbeat token refresh flow (commit fe82348d160904d0013b9a3e267d50158f5c7afb) (FUXA Release, FUXA Advisory). As an interim measure, restrict network access to the FUXA web interface (default port 1881) using firewall rules, VPNs, or network segmentation to limit exposure to trusted hosts only. Organizations should treat all FUXA deployments running versions prior to 1.2.10 as critically at risk and prioritize patching immediately, particularly given the ICS/SCADA context of the software.

The vulnerability was noted by security researchers and aggregated by multiple vulnerability tracking platforms shortly after disclosure in February 2026, including coverage on Vulners, VulDB, INCIBE-CERT, and the ENISA EUVD (Feedly). A dedicated technical write-up was published by Infinitsec describing the attack chain as "Unauthenticated Remote Code Execution via Admin JWT Minting" (Infinitsec). Community discussion was observed on Mastodon/infosec.exchange, reflecting awareness in the security research community. Red Hat also tracked the advisory, indicating broader vendor ecosystem awareness (Red Hat).