{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afrangoteamfuxa1.1.13/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:frangoteam:fuxa:1.1.13:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2023-33831"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Fuxa (1.1.13)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","cve","web-application","injection"],"_cs_type":"advisory","_cs_vendors":["Frangoteam"],"content_html":"\u003cp\u003eFrangoteam Fuxa version 1.1.13 is susceptible to unauthenticated Remote Command Execution (RCE). An attacker can trigger this vulnerability by sending a crafted HTTP POST request to the '/api/runscript' endpoint. The 'code' parameter within the request body is not properly sanitized, allowing for arbitrary command execution on the underlying server. Publicly available exploit code and proof-of-concept (PoC) material have been released, elevating the risk of exploitation.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full remote command execution with the privileges of the Fuxa application process, allowing an attacker to achieve total system compromise, including data exfiltration, lateral movement, and system disruption.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all instances of Frangoteam Fuxa version 1.1.13 within the environment.\u003c/li\u003e\n\u003cli\u003eImplement a web application firewall (WAF) rule to block or inspect HTTP POST requests targeting the '/api/runscript' endpoint containing suspicious payloads in the 'code' parameter.\u003c/li\u003e\n\u003cli\u003eMonitor server-side logs and network traffic for outbound connections from the application server, particularly those directed toward non-standard ports such as 1881, which are commonly utilized in the public PoC.\u003c/li\u003e\n\u003cli\u003eUpgrade to a patched version of Fuxa immediately if one is available.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-23T16:38:02Z","date_published":"2026-10-23T16:38:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fuxa-rce-cve-2023-33831/","summary":"Frangoteam Fuxa version 1.1.13 contains an unauthenticated remote command execution vulnerability in the /api/runscript endpoint due to improper sanitization of the code parameter.","title":"Frangoteam Fuxa: Remote Command Execution via /api/runscript (CVE-2023-33831)","url":"https://feed.craftedsignal.io/briefs/2026-10-fuxa-rce-cve-2023-33831/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:frangoteam:fuxa:1.1.13:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}