FUXA: Authorization bypass in /nodered route allows code execution
Summary
FUXA, a web-based HMI software, contains an authorization bypass in its optional Node-RED integration served under /nodered. An unauthenticated attacker can send a specially crafted HTTP request, for example by obtaining a guest token from the /api/heartbeat route, to pass the access check. This can lead to arbitrary code execution on the device, including deploying malicious Node-RED flows. Exploitation requires that the Node-RED integration is enabled and reachable over the network.
Affected
- FUXA 1.3.2-2809 (confirmed by Talos and the vendor)
- Older versions: Unknown.
Fixed in
- Fixed in FUXA 1.3.3 (vendor information)
Workaround
- No vendor workaround known.
- If Node-RED is not needed, disable it (to be verified on your system).
- Restrict network access to FUXA to trusted operator networks.
- Run the FUXA service under a least-privilege account.
Exploitation
- No confirmed exploitation in the wild.
- No public proof of concept found.
- CISA SSVC: Automatable yes, technical impact total.
Our recommendation
- Inventory all FUXA instances and versions, including test and remote-access systems.
- Upgrade FUXA 1.3.2-2809 and older to 1.3.3 or later.
- Disable Node-RED if unused; otherwise make sure /nodered is not reachable from the internet.
- Use VPN or a jump host for remote access instead of direct exposure.
- Review web logs for unexpected requests to /nodered on internet-facing instances.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Cisco Talos TALOS-2026-2419 talosintelligence.com
- VulDB CVE-2026-42922 vuldb.com
- VulDB 428278 vuldb.com
- OffSeq Radar threat entry radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 16:11.
Original description (NVD)
A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to a arbitrary code execution. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.