Critical severity · published Feb 3, 2026
CVE-2025-69970
FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js
9.3
CVSS
0.5%
EPSS
No
On KEV
Description
FUXA v1.2.7 contains an insecure default configuration vulnerability in server/settings.default.js. The 'secureEnabled' flag is commented out by default, causing the application to initialize with authentication disabled. This allows unauthenticated remote attackers to access sensitive API endpoints, modify projects, and control industrial equipment immediately after installation.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FU
Fuxa · Frangoteam
1.2.7 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-69970
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-69970
Product
https://github.com/frangoteam/FUXA/blob/master/server/settings.default.js
More from Fuxa
9.8
CVE-2025-69985
FUXA 1.2.8 and prior contains an Authentication Bypass vulnerability leading to Remote Code Execution (RCE)
9.8
CVE-2026-25895
FUXA Unauthenticated Remote Code Execution via Arbitrary File Write in Upload API
9.8
CVE-2026-25894
FUXA Unauthenticated Remote Code Execution via Hardcoded JWT Secret in Default Configuration
9.8
CVE-2026-25893
FUXA Unauthenticated Remote Code Execution via Admin JWT Minting
9.8
CVE-2026-25938
FUXA Unauthenticated Remote Code Execution in Node-RED Integration