Code Injection Vulnerability in beecue FastBee Groovy Script Executor
CVE-2026-120274

5.1MEDIUM

Key Information:

Vendor

Beecue

Status
Fastbee
Vendor
CVE Published:
1 November 2026

What is CVE-2026-120274?

A code injection vulnerability has been discovered in the beecue FastBee product, specifically affecting the Groovy Script Executor component in versions up to 2.1.0. This flaw allows for remote code manipulation through unspecified functionalities in the /iot/script file. Attackers can exploit this issue to execute arbitrary code, posing significant security risks to affected systems. It is strongly recommended to apply the patch identified by commit 890a33846005a937a58cccd738b7fb9821b82ea9 to safeguard against potential attacks.

Affected Version(s)

FastBee 2.0

FastBee 2.1.0

References

https://vuldb.com/vuln/429618
vdb-entry
https://vuldb.com/vuln/429618/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-120274
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

0n1on (VulDB User)
.