Description
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
rodolfomarianocy/Unauthenticated-RCE-FUXA-CVE-2023-33831 ★ 13 · Sep 3, 2023
Description and exploit of CVE-2023-33831 affecting FUXA web-based Process Visualization (SCADA/HMI/Dashboard) software.
-
btar1gan/exploit_CVE-2023-33831 ★ 0 · Sep 13, 2024
New exploit for FUXA v1.1.13 - Unauthenticated remote code excecution
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- FUXA - Unauthenticated Remote Code Execution http/cves/2023/CVE-2023-33831.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | @frangoteam/fuxa | <= 1.1.13 | — | GHSA-r87q-fq37-pvr6 |