---
cve: "CVE-2026-25893"
severity: "CRITICAL"
cvss: 10.0
epss: "0.8%"
vendor: "frangoteam"
kev: false
exploited: false
published: "2026-02-09 23:16:05"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T11:51:28+01:00"
---

# CVE-2026-25893

> 10.0 CRITICAL · 🧪 PoC

## Beschreibung

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vulnerability in FUXA allows an unauthenticated, remote attacker to gain administrative access via the heartbeat refresh API and execute arbitrary code on the server. This issue has been patched in FUXA version 1.2.10.

## CNA-Record (Kanon, cvelistV5)

- CNA: **GitHub_M**
- State: PUBLISHED
- Stand: 2026-02-11 21:25:42
- CNA-CVSS: **10.0** (`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |

## Schwachstellen-Klasse

- **CWE-285** — Improper Authorization
  The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- **CWE-287** — Improper Authentication
  When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

## Angriffsmuster (CAPEC)

- [CAPEC-1 — Accessing Functionality Not Properly Constrained by ACLs](https://capec.mitre.org/data/definitions/1.html) _(Severity: High)_
- [CAPEC-13 — Subverting Environment Variable Values](https://capec.mitre.org/data/definitions/13.html) _(Severity: Very High)_
- [CAPEC-17 — Using Malicious Files](https://capec.mitre.org/data/definitions/17.html) _(Severity: Very High)_
- [CAPEC-39 — Manipulating Opaque Client-based Data Tokens](https://capec.mitre.org/data/definitions/39.html) _(Severity: Medium)_
- [CAPEC-45 — Buffer Overflow via Symbolic Links](https://capec.mitre.org/data/definitions/45.html) _(Severity: High)_
- [CAPEC-104 — Cross Zone Scripting](https://capec.mitre.org/data/definitions/104.html) _(Severity: High)_
- [CAPEC-127 — Directory Indexing](https://capec.mitre.org/data/definitions/127.html) _(Severity: Medium)_
- [CAPEC-402 — Bypassing ATA Password Security](https://capec.mitre.org/data/definitions/402.html)

## ATT&CK-Techniken

- [T1574.010 — Hijack Execution Flow: ServicesFile Permissions Weakness](https://attack.mitre.org/techniques/T1574/010/)
- [T1562.003 — Impair Defenses:Impair Command History Logging](https://attack.mitre.org/techniques/T1562/003/)
- [T1574.006 — Hijack Execution Flow:Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006/)
- [T1574.007 — Hijack Execution Flow:Path Interception by PATH Environment ](https://attack.mitre.org/techniques/T1574/007/)
- [T1574.005 — Hijack Execution Flow: Executable Installer File Permissions](https://attack.mitre.org/techniques/T1574/005/)
- [T1083 — File and Directory Discovery](https://attack.mitre.org/techniques/T1083/)

## Patch verfügbar (OSV)

- b873cdf32a63bcfaa6de8b724781f63c6f977c69 (Commit)
- fe82348d160904d0013b9a3e267d50158f5c7afb (Commit)

## Referenzen

- <https://github.com/frangoteam/FUXA/security/advisories/GHSA-vwcg-c828-9822>
- <https://github.com/frangoteam/FUXA/commit/fe82348d160904d0013b9a3e267d50158f5c7afb>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-25893/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_