Exploit for CVE-2025-69985

kitploit · 2026-09-11

Description

Auth bypass in FUXA ≤ 1.2.8 via /api/runscript enables unauthenticated remote code execution.

Entry point

Parameterparams · request body

Path/api/runscript

Authentication bypass via Referer header to /api/runscript enabling Remote Code Execution

Affected Frangoteam Fuxa versions

Frangoteam Fuxa≤ 1.2.8

All known vulnerabilities by product

CVSS 9.8 for CVE-2025-69985

9.8

HIGH SEVERITY

Version 3.1

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector:NETWORK

Attack Complexity:LOW

Privileges Required:NONE

User Interaction:NONE

Scope:UNCHANGED

Confidentiality:HIGH

Integrity:HIGH

Availability:HIGH

EPSS Score

5.6%higher than 92.5% of all CVEs

Updated 2026-09-11

CVE Information

Exploit Details

Modified:2026-09-11 13:26

Last Seen:2026-09-11 14:18

Reporter:KitPloit

Tags

FUXAauthentication bypassremote code executionrunscript endpointSCADA HMINode.js injection

Other exploits for CVE-2025-69985

2026-09-10 KitPloitKITPLOIT

Exploit for Authentication Bypass Using an Alternate Path or Channel in Frangoteam Fuxa

2026-05-04 kaleth4GITHUB

Exploit for Authentication Bypass Using an Alternate Path or Channel in Frangoteam Fuxa

2026-05-02 ladybugsagaGITHUB

FUXA 1.2.8 - Authentication Bypass + RCE Exploit

2026-04-30 joshuaEXPLOITDB

📄 FUXA 1.2.8 Authentication Bypass / Remote Code Execution

2026-02-27 indoushkaPACKETSTORMRuby

📄 FUX 1.2.8 Authentication Bypass / Remote Command Execution

2026-02-25 Joshua van der pollPACKETSTORMPython

Exploit for CVE-2025-69985

2026-02-25 joshuavanderpollGITHUB

Exploit Code

MARKDOWN23 lines

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-JOSHUAVANDERPOLL-CVE-2025-69985
# FUXA ≤ 1.2.8 Auth Bypass + RCE (CVE-2025-69985)

![](https://api.visitorbadge.io/api/visitors?path=https://github.com/joshuavanderpoll/CVE-2025-69985&label=Views&countColor=%2337d67a) ![Python](https://img.shields.io/badge/python-3670A0?style=for-the-badge&logo=python&logoColor=ffdd54)

## 📜 Description

This Python exploit targets CVE-2025-69985, a critical authentication bypass vulnerability in FUXA (web-based SCADA/HMI software) versions ≤ 1.2.8. By sending a crafted JSON payload with embedded Node.js code to the unprotected /api/runscript endpoint, it achieves remote command execution as the FUXA process — capturing full stdout/stderr synchronously in the response.

## 🛠️ Installation

> [!NOTE] To ensure a clean and isolated environment for the project dependencies, it's recommended to use Python's `venv` module.

### OSX/Linux

root@kitploit:~
    
    
    git clone https://github.com/joshuavanderpoll/CVE-2025-69985.git
    cd CVE-2025-69985
    python3 -m venv .venv
    source .venv/bin/activate
    pip3 install -r requirements.txt