CVE-2026-120274

MEDIUM 4.7

beecue FastBee Groovy Script Executor script code injection

CVSS Score

4.7

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.

CWE	CWE-94 CWE-74
Vendor	beecue
Product	fastbee
Published	Nov 1, 2026

Stay Ahead of the Next One

Get instant alerts for beecue fastbee

Be the first to know when new medium vulnerabilities affecting beecue fastbee are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

beecue / FastBee

2.0 2.1.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/429618 vuldb.com: https://vuldb.com/vuln/429618/cti vuldb.com: https://vuldb.com/cve/CVE-2026-120274 vuldb.com: https://vuldb.com/submit/1003643 gitee.com: https://gitee.com/x0n1on/fastbee/issues/IKIU7D gitee.com: https://gitee.com/beecue/fastbee/commit/890a33846005a937a58cccd738b7fb9821b82ea9 gitee.com: https://gitee.com/beecue/fastbee/

Credits

🔍 0n1on (VulDB User)