---
id: "CVE-2026-120274"
kind: "vulnerability"
aliases: ["CVE-2026-120274"]
title: "FastBee IoT platform: remote code injection through Groovy script executor"
severity: "medium"
cvss: 5.8
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["fastbee", "groovy", "iot", "other", "self-hosted"]
not_affected_if: ["fastbee-newer-than-2.1.0", "script-endpoint-blocked"]
published_at: "2026-11-01T21:17:08+00:00"
first_seen_at: "2026-11-01T21:22:18+00:00"
updated_at: "2026-11-01T21:24:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120274", "first_seen_at": "2026-11-01T21:22:18+00:00"}]
---

# FastBee IoT platform: remote code injection through Groovy script executor

FastBee, an IoT platform, has a flaw in its Groovy Script Executor component reached through the /iot/script file. A remote attacker can inject code that the server then runs.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the FastBee version in use is `2.1.0` or earlier.
- Look for the `/iot/script` endpoint in the deployed application.

## Fix

- Install the patch identified as `890a33846005a937a58cccd738b7fb9821b82ea9`; the sources give no fixed release version.

## Timeline

- 2026-11-01T21:22:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120274

## From the sources

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_