CVE-2026-120274 json
beecue FastBee Groovy Script Executor script code injection
published 2026-11-01 7 d ago modified 2026-11-02 6 d ago also EUVD-2026-114885
- cvss
- 4.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 16%
- public exploits
- 0
- none known
Summary
A vulnerability was identified in beecue FastBee up to 2.1.0. Affected by this issue is some unknown functionality of the file /iot/script of the component Groovy Script Executor. The manipulation leads to code injection. The attack is possible to be carried out remotely. The identifier of the patch is 890a33846005a937a58cccd738b7fb9821b82ea9. It is suggested to install a patch to address this issue.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 d ago
Exploit prediction
0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X |
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C |
| CNA | 3.0 | 4.7 | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C |
| CNA | 2.0 | 5.8 | AV:N/AC:L/Au:M/C:P/I:P/A:P/E:ND/RL:OF/RC:C |
| CNA | 4.0 | 5.1 | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 4.7 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L |
| CNA | 2.0 | 5.8 | AV:N/AC:L/Au:M/C:P/I:P/A:P |
Affected products
- beecue FastBee
Classification
References
-
gitee.com
/beecue/fastbee/commit/890a33846005a937a58cccd738b7fb9821b82ea9
patch
-
vuldb.com
/vuln/429618
vdb-entry
-
vuldb.com
/vuln/429618/cti
signature, permissions-required
-
vuldb.com
/cve/CVE-2026-120274
third-party-advisory
-
vuldb.com
/submit/1003643
third-party-advisory
-
gitee.com
/x0n1on/fastbee/issues/IKIU7D
issue-tracking
-
gitee.com
/beecue/fastbee/
product
Sources
- CVE List CVE-2026-120274
- NVD CVE-2026-120274
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.