beecue FastBee Groovy Script Executor script code injection
Affects FastBee v2.1.0 and earlier with the default admin/admin123 password unchanged. No fixed version is listed; the workaround is to change the default password and enforce a weak-password policy.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 13/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The beecue FastBee IoT platform, up to version 2.1.0, contains a flaw in its Groovy Script Executor component that can be triggered remotely. An attacker could abuse this to inject and run arbitrary code on the affected system.
Read the original description
A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.
What to do
Check whether your setup matches what the bug needs.
Affects FastBee v2.1.0 and earlier affected versions Default admin password (admin/admin123) has not been changed A device property report or platform function dispatch message triggers the rule scriptApply the patch listed under Evidence.
Workaround: Forcibly change the default password and enforce a weak-password policy
Timeline
- CVE published
- First seen by cve.now
Affected versions
- beecue FastBee
2.0, 2.1.0
Evidence 7
- Advisory
- Advisory
- Advisory
- Advisory
- Patch
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-120274
What does this mean?
A device property report or a platform function dispatch message can trigger the rule script handling, which allows arbitrary command execution on the server as the service account. That can lead to reading the database and moving into the internal network.Source: gitee.com
Am I affected, and how do I check?
FastBee v2.1.0 and earlier versions are listed as affected, and the default admin password admin/admin123 must still be in place. To check, look at the FastBee version in use and whether the admin account still uses the official default password.Source: gitee.com
What should I do about it?
No fixed version is listed in the available information, so no upgrade target can be given. Change the default admin password now and enforce a weak-password policy.Source: gitee.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data