Live › vulnerability › CVE-2026-42949
FUXA, a web-based SCADA and HMI tool, has an authorization bypass in its /api/runscript endpoint, version 1.3.2-2809 named in the advisory. A specially crafted unauthenticated HTTP request can trigger a privileged operation on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 04:41 UTC. All times on this page are UTC.
FUXA instances exposed to a network that untrusted users can reach, particularly the HTTP interface that serves /api/runscript. The advisory names version 1.3.2-2809; the sources do not state which other versions are affected or what a privileged operation includes. Teams that keep FUXA off untrusted networks have less exposure.
No product ranges from the sources yet.
1.3.2-2809, the version named in the NVD entry.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request can lead to execute priviledged operation. An attacker can make an unauthenticated HTTP request to trigger this vulnerability.
This page as .md · .json · in your agent: get_signal("CVE-2026-42949")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.