{"id":"CVE-2026-120274","kind":"vulnerability","aliases":["CVE-2026-120274"],"related":[],"title":"FastBee IoT platform: remote code injection through Groovy script executor","description":"A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.","summary":"FastBee, an IoT platform, has a flaw in its Groovy Script Executor component reached through the /iot/script file. A remote attacker can inject code that the server then runs.","severity":"medium","cvss":5.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["fastbee","groovy","iot","other","self-hosted"],"not_affected_if":["fastbee-newer-than-2.1.0","script-endpoint-blocked"],"how_to_check":"- Check whether the FastBee version in use is `2.1.0` or earlier.\n- Look for the `/iot/script` endpoint in the deployed application.","fix":"- Install the patch identified as `890a33846005a937a58cccd738b7fb9821b82ea9`; the sources give no fixed release version.","status":"open","published_at":"2026-11-01T21:17:08+00:00","first_seen_at":"2026-11-01T21:22:18+00:00","triaged_at":"2026-11-01T21:24:12+00:00","updated_at":"2026-11-01T21:24:12+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-01T21:24:12Z","model":"claude-haiku-5-5","output":{"fix":"- Install the patch identified as `890a33846005a937a58cccd738b7fb9821b82ea9`; the sources give no fixed release version.","reach":"internet","title":"FastBee IoT platform: remote code injection through Groovy script executor","impact":"high","summary":"FastBee, an IoT platform, has a flaw in its Groovy Script Executor component reached through the /iot/script file. A remote attacker can inject code that the server then runs.","audience":"businesses","category":"other","nicknames":[],"who_cares":["fastbee","iot","groovy","self-hosted"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker runs arbitrary code on the FastBee server remotely","analyst_note":"Confirm whether authentication is required for /iot/script and whether the script executor is enabled by default; check the NVD and the referenced patch commit for the fixed version.","how_to_check":"- Check whether the FastBee version in use is `2.1.0` or earlier.\n- Look for the `/iot/script` endpoint in the deployed application.","plain_action":"","needs_analyst":true,"not_affected_if":["fastbee-newer-than-2.1.0","script-endpoint-blocked"],"who_is_affected":"Teams that run a self-hosted FastBee IoT platform at version 2.1.0 or earlier with the Groovy script executor exposed. Instances that do not run FastBee, or that block the /iot/script path from untrusted networks, are less exposed. The sources do not say which default configuration enables the script executor.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000705,"input_tokens":4153,"output_tokens":579,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120274':13A,16A '-2026':12A,15A '/iot/script':40B,74C '2.1.0':62C '890a33846005a937a58cccd738b7fb9821b82ea9':102C 'address':111C 'affect':63C 'attack':44B,88C 'beecu':58C 'carri':93C 'code':5A,47B,85C 'compon':36B,77C 'cve':11A,14A 'executor':10A,35B,80C 'fastbe':1A,17B,24B,59C 'file':41B,73C 'flaw':30B 'function':70C 'groovi':8A,18B,33B,78C 'host':23B 'identifi':56C,97C 'inject':6A,46B,86C 'instal':107C 'iot':2A,19B,26B 'issu':66C,113C 'lead':83C 'manipul':82C 'patch':100C,109C 'platform':3A,27B 'possibl':90C 'reach':37B 'remot':4A,43B,95C 'run':52B 'script':9A,34B,79C 'self':22B 'self-host':21B 'server':50B 'suggest':105C 'unknown':69C 'vulner':54C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a self-hosted FastBee IoT platform at version 2.1.0 or earlier with the Groovy script executor exposed. Instances that do not run FastBee, or that block the /iot/script path from untrusted networks, are less exposed. The sources do not say which default configuration enables the script executor.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T21:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120274","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120274","severity":null,"published_at":"2026-11-01T21:17:08+00:00","modified_at":"2026-11-01T21:17:09+00:00","first_seen_at":"2026-11-01T21:22:18+00:00","fetched_at":"2026-11-01T21:22:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}