An unauthenticated attacker can exploit an authentication bypass in the heartbeat refresh API of FUXA, allowing arbitrary code execution on the server. The flaw stems from improperly validated JWT creation, falling under authorization and authentication weaknesses. The attacker gains full administrative control without needing credentials, potentially compromising confidentiality, integrity, and availability of the SCADA environment.

FUXA Process Visualization software from frangoteam. Versions prior to 1.2.10 are vulnerable; the fix is released in 1.2.10. Upstream product is the web-based HMI dashboard for industrial control systems.

The vulnerability scores a perfect CVSS of 10, but its EPSS is listed as < 1%, indicating very low current exploitation probability. It is not in the CISA KEV catalog. Exploitation requires network access to the heartbeat endpoint and no authentication; the attacker can craft a JWT and trigger administrative actions.