CVE-2025-69970: FUXA Server Insecure Default Configuration Vulnerability
Summary
CVE-2025-69970: FUXA contains an insecure default configuration vulnerability. Affects fuxa-server versions < 1.2.7. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FUXA is an open-source server application designed for managing industrial equipment and projects. It provides a range of functionalities, including API access for project management and equipment control. However, FUXA v1.2.7 has been identified with a significant security flaw due to an insecure default configuration that can expose sensitive endpoints to unauthorized access.
Vulnerability Detail
The vulnerability in FUXA arises from the 'secureEnabled' flag being commented out in the default configuration file (server/settings.default.js). This misconfiguration leads to the application starting with authentication disabled, allowing unauthenticated remote attackers to access sensitive API endpoints, modify projects, and potentially control industrial equipment immediately after installation. The ramifications of this vulnerability are severe, as it can lead to unauthorized access and manipulation of critical systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can manually enable authentication by editing the server/settings.default.js file. Locate the 'secureEnabled' flag and uncomment it by removing the preceding '//'. This will ensure that authentication is enabled until a permanent fix is applied.
Conclusion
The FUXA server vulnerability (CVE-2025-69970) presents a serious risk due to its insecure default configuration, allowing unauthorized access to sensitive functionalities. It is crucial for users to update to a patched version and implement the recommended fixes to safeguard their systems.
See every vulnerability recorded for fuxa-server →
FAQ
The CVSS score of this vulnerability is 8.0, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
The consequences include unauthorized access to sensitive API endpoints, project modifications, and control over industrial equipment, which can lead to significant operational risks.
Yes, any version later than 1.2.7 is considered safe as it addresses the insecure default configuration issue.
If an immediate update is not possible, ensure to enable authentication by uncommenting the 'secureEnabled' flag in the server/settings.default.js file as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for fuxa-server.
