Live › vulnerability › CVE-2026-120274
FastBee, an IoT platform, has a flaw in its Groovy Script Executor component reached through the /iot/script file. A remote attacker can inject code that the server then runs.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 21:22 UTC. All times on this page are UTC.
Teams that run a self-hosted FastBee IoT platform at version 2.1.0 or earlier with the Groovy script executor exposed. Instances that do not run FastBee, or that block the /iot/script path from untrusted networks, are less exposed. The sources do not say which default configuration enables the script executor.
No product ranges from the sources yet.
2.1.0 or earlier./iot/script endpoint in the deployed application.890a33846005a937a58cccd738b7fb9821b82ea9; the sources give no fixed release version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-120274")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.