CVE-2026-120274 Details
Description
A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.
A remote code execution vulnerability exists in Beecue FastBee versions through 2.1.0. The issue arises from the Groovy Script Executor component, specifically within an unknown functionality of the file '/iot/script'. This vulnerability allows for code injection, as the script execution environment lacks proper sanitization and isolation, enabling unauthorized script execution with administrative privileges.
It is recommended to sandbox the execution of rule engine scripts to prevent dangerous calls related to processes, files, or reflection. Alternatively, a restricted domain-specific language could be used. The dynamic language support that allows execution of arbitrary Java code should be removed from the script executor. Additionally, users should be forced to change the default password, implement a weak password policy, and enhance authentication credential management.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://gitee.com/beecue/fastbee/ | [email protected] | Vendor |
| https://gitee.com/beecue/fastbee/commit/890a33846005a937a58cccd738b7fb9821b82ea9 | [email protected] | Source CodeVendor |
| https://gitee.com/x0n1on/fastbee/issues/IKIU7D | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://vuldb.com/cve/CVE-2026-120274 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1003643 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/429618 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/429618/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| beecue FastBee | <= 2.1.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | [email protected] |