Description
A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.
Published: 2026-11-01
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

A code injection flaw exists in the Groovy Script Executor component of beecue FastBee, allowing an attacker to execute arbitrary code via manipulated Groovy scripts submitted to the /iot/script endpoint. The vulnerability maps to CWE-74 and CWE-94 and can compromise the confidentiality and integrity of the host system.

Affected Systems

Vulnerable versions of beecue FastBee up to 2.1.0 are affected; any installation running these releases is at risk.

Risk and Exploitability

The CVSS score of 5.1 indicates a moderate severity. The vulnerability is exploitable remotely without local presence, though no EPSS data is available and it is not listed in the CISA KEV catalog. An attacker who successfully injects code can gain full control over the affected device.

Generated by OpenCVE AI on November 1, 2026 at 22:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch committed as 890a33846005a937a58cccd738b7fb9821b82ea9 or upgrade to a FastBee release newer than 2.1.0,
  • Disable or restrict access to the /iot/script endpoint until the fix is applied,
  • Monitor system logs for unexpected Groovy script execution or unauthorized code activity

Generated by OpenCVE AI on November 1, 2026 at 22:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 01 Nov 2026 21:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.
Title beecue FastBee Groovy Script Executor script code injection
First Time appeared Beecue
Beecue fastbee
Weaknesses CWE-74
CWE-94
CPEs cpe:2.3:a:beecue:fastbee:*:*:*:*:*:*:*:*
Vendors & Products Beecue
Beecue fastbee
References
Metrics cvssV2_0

{'score': 5.8, 'vector': 'AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.7, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

Beecue Fastbee
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-11-01T21:00:27.286Z

Reserved: 2026-11-01T07:34:56.590Z

Link: CVE-2026-120274

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-01T21:17:08.157

Modified: 2026-11-01T21:17:09.303

Link: CVE-2026-120274

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-01T22:30:12Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-94

    Improper Control of Generation of Code ('Code Injection')