Description
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.
Published: 2026-10-13
Score: 8.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized Device Access
Action: Patch
AI Analysis

Impact

FastBee versions through 2.1.0 contain a classic Insecure Direct Object Reference flaw in the DeviceController. The flaw allows an attacker who has authenticated with low privileges to read metadata and configuration from other tenants’ devices by simply iterating through numeric or serial identifiers. Once accessed, the attacker can overwrite the user_id and tenant_id fields, effectively hijacking the device and gaining full administrative control, compromising both confidentiality and integrity of device data across multiple tenants.

Affected Systems

The affected product is FastBee from kerwincui. All releases up to and including version 2.1.0 are impacted. The vulnerability persists in any 2.x build that has not applied the latest security patch.

Risk and Exploitability

The CVSS score of 8.6 categorizes the bug as High severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog, indicating no publicly known exploits as of this analysis. The attack requires an authenticated user account with low privileges and an ability to send sequential requests to the /iot/device endpoints; this makes exploitation straightforward via automated enumeration or manual testing.

Generated by OpenCVE AI on October 13, 2026 at 19:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FastBee to the latest version where the IDOR fix has been applied.
  • If an immediate upgrade is not feasible, restrict access to the /iot/device API endpoints so that only the owning tenant can query or modify devices, and block arbitrary ID enumeration by adding rate limiting and input validation.
  • Conduct an audit of all device records to detect any illicit changes to user_id or tenant_id fields, and revoke accounts that may have been compromised.

Generated by OpenCVE AI on October 13, 2026 at 19:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Kerwincui
Kerwincui fastbee
Vendors & Products Kerwincui
Kerwincui fastbee

Tue, 13 Oct 2026 17:15:00 +0000

Type Values Removed Values Added
Description FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.
Title FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N'}

cvssV4_0

{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Kerwincui Fastbee
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-14T15:52:32.042Z

Reserved: 2026-10-13T16:24:39.155Z

Link: CVE-2026-110124

cve-icon Vulnrichment

Updated: 2026-10-14T15:51:50.108Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T17:17:37.080

Modified: 2026-10-16T19:18:44.867

Link: CVE-2026-110124

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T19:15:08Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key