CVE-2026-120274
Deferred Deferred - Pending Action

Code Injection in FastBee up to 2.1.0

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: VulDB

Description
A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-02
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-120274

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
beecue FastBee 2.0
beecue FastBee 2.1.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120274 is a code injection vulnerability in beecue FastBee up to version 2.1.0. The issue exists in the Groovy Script Executor component, specifically in the file /iot/script. Attackers can remotely inject malicious code due to improper handling of unsanitized Groovy scripts in the rule engine. The vulnerability allows immediate execution of scripts without sandboxing or restrictions.

Detection Guidance

Check for unauthorized Groovy scripts in /iot/script directory of FastBee installations. Inspect network traffic for suspicious outbound connections from the FastBee server. Review admin account activity logs for unusual login times or commands.

Impact Analysis

This vulnerability can lead to full server compromise if exploited. Attackers with admin access (using default credentials like admin/admin123) can execute arbitrary commands, access databases, and move laterally within the network. The flaw enables remote code execution (RCE) through the rule engine, potentially allowing complete control over the FastBee platform and connected IoT devices.

Mitigation Strategies

Update FastBee to the latest patched version. Disable default admin credentials and enforce strong passwords. Implement script sandboxing and approval workflows for Groovy script changes. Restrict network access to the FastBee server and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120274. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...