The AppSec Research team at Positive Technologies identified a critical vulnerability in FUXA, an open-source platform for SCADA and HMI systems. The flaw, classified as CWE-862, allowed unauthorized users with guest tokens to bypass authentication and gain administrative access to the Node-RED interface.
Exploitation of this vulnerability enabled attackers to modify automation scripts, access files, and execute system commands with the privileges of the FUXA process. This posed significant risks to industrial environments using protocols such as Modbus, MQTT, and Siemens S7.
The discovery was facilitated by a new AI tool currently being tested by Positive Technologies. The system autonomously performed a full security analysis, including threat modeling, vulnerability detection, exploit verification, and the generation of a patch, mirroring the workflow of a human AppSec specialist.
FUXA has been downloaded over 100,000 times and has garnered more than 5,000 stars on GitHub. The vulnerability was addressed in version 1.3.3, which restricts Node-RED access to authenticated users and API key holders. Developers advise users to update their installations immediately.
