An unauthenticated remote attacker can exploit an authorization bypass within FUXA to create or modify arbitrary schedulers. The vulnerability allows the attacker to assign any desired operation to a scheduled task, potentially triggering actions that compromise connected industrial control or SCADA environments. Because the attacker requires no credentials, the impact is that any user or system tied to the scheduler could be manipulated to perform unintended operations, leading to integrity and availability violations for the target infrastructure.

The affected product is FUXA by frangoteam. Versions from 1.2.8 through 1.2.10 are vulnerable; the issue was resolved in version 1.2.11.

The vulnerability carries a CVSS score of 9.3, indicating critical severity. The EPSS score is below 1 %, suggesting a low but non‑zero exploitation probability, and the flaw is not yet listed in the CISA KEV catalog. Exploitation requires only access to the FUXA web interface and can be carried out remotely without authentication. An attacker can send crafted requests to the scheduler endpoints, causing the creation or alteration of scheduled tasks that will execute once the scheduled time is reached. This attack vector highlights the importance of immediate containment and remediation.