FastBee CVE-2026-120274

Exploitation requires an authenticated, high-privilege account (CVSS PR:H) with access to the Groovy Script Executor component exposed at /iot/script in FastBee up to and including 2.1.0; the attacker must be able to submit script content that the executor processes. Limiting factors: this is not reachable by unauthenticated users - privileged access to the scripting feature is mandatory, which confines realistic exploitation to authorized operators or attackers who have first obtained privileged credentials. No user interaction is required (UI:N). The precise configuration or payload that triggers the injection is not described in the available sources.

This is a moderate-severity issue (CVSS 4.0 base 5.1) whose real-world urgency is tempered by its privilege requirement. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N) indicates a network-reachable, low-complexity flaw but with PR:H - exploitation requires high privileges on the FastBee instance, and impact to confidentiality, integrity and availability is each rated Low rather than High. This materially contradicts the 'RCE' tag: code injection into a Groovy Script Executor would typically yield full code execution (I/A:H), yet the vendor/VulDB vector scores all impacts Low, so the 'RCE' framing overstates the rated severity and should be verified against the actual executor sandboxing. No EPSS score and no CISA KEV listing were provided, and there is no input line confirming working exploit code; a public vulnerability-report reference exists on Gitee but is not verified as a functional exploit. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a patch-this-cycle priority rather than a drop-everything emergency. Net assessment: a legitimate but not top-tier issue - prioritize because it is a code-injection path and a patch exists, but the PR:H prerequisite and Low impact ratings argue against treating it as a critical unauthenticated RCE.

An attacker who already holds a privileged account on a FastBee deployment (up to 2.1.0) reaches the Groovy Script Executor at /iot/script over the network and submits crafted Groovy content that is injected and executed by the server-side executor. A public vulnerability-report reference exists on Gitee, but it is not verified as working exploit code; the specific injection trigger is not described in the available sources. Because the CVSS vector requires high privileges (PR:H), this is a post-authentication abuse of an administrative scripting feature rather than a drive-by remote compromise.