Cpe:2.3:a:frangoteam:fuxa:1.1.13:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3afrangoteamfuxa1.1.13/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 23 Oct 2026 16:38:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgFrangoteam Fuxa: Remote Command Execution via /api/runscript (CVE-2023-33831)https://feed.craftedsignal.io/briefs/2026-10-fuxa-rce-cve-2023-33831/Fri, 23 Oct 2026 16:38:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-fuxa-rce-cve-2023-33831/Frangoteam Fuxa version 1.1.13 contains an unauthenticated remote command execution vulnerability in the /api/runscript endpoint due to improper sanitization of the code parameter.Frangoteam Fuxa version 1.1.13 is susceptible to unauthenticated Remote Command Execution (RCE). An attacker can trigger this vulnerability by sending a crafted HTTP POST request to the '/api/runscript' endpoint. The 'code' parameter within the request body is not properly sanitized, allowing for arbitrary command execution on the underlying server. Publicly available exploit code and proof-of-concept (PoC) material have been released, elevating the risk of exploitation.

Impact

Successful exploitation results in full remote command execution with the privileges of the Fuxa application process, allowing an attacker to achieve total system compromise, including data exfiltration, lateral movement, and system disruption.

Recommendation

  • Identify all instances of Frangoteam Fuxa version 1.1.13 within the environment.
  • Implement a web application firewall (WAF) rule to block or inspect HTTP POST requests targeting the '/api/runscript' endpoint containing suspicious payloads in the 'code' parameter.
  • Monitor server-side logs and network traffic for outbound connections from the application server, particularly those directed toward non-standard ports such as 1881, which are commonly utilized in the public PoC.
  • Upgrade to a patched version of Fuxa immediately if one is available.
]]>criticaladvisoryremote-code-executioncveweb-applicationinjection