FUXA Insecure Default Configuration Vulnerability Allowing Unauthenticated Access to Sensitive API Endpoints

A vulnerability exists in FUXA version 1.2.7 due to an insecure default configuration in the file server/settings.default.js. The 'secureEnabled' flag is disabled by default, which allows the application to start with authentication turned off. This misconfiguration enables unauthenticated remote attackers to access sensitive API endpoints, alter projects, and control industrial equipment immediately after installation.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive API endpoints, project modification, and control over industrial equipment.