Fastbee
Monthly
Cross-tenant object reference flaw in FastBee through 2.1.0 lets any authenticated tenant user read another tenant's MQTT account, password and secret values, and overwrite or delete foreign product records, by supplying or enumerating sequential product IDs. The by-ID endpoints in ProductController enforced only RuoYi permission strings and omitted the tenant-ownership scoping that the list query applies at the service layer, which yields high confidentiality and integrity impact with limited availability impact (reported CVSS 4.0 score 8.7; independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Exploitation requires a valid tenant account on a multi-tenant deployment where other tenants' products exist, and no public exploit code or active exploitation was identified at time of analysis.
Code injection in the Groovy Script Executor component of beecue FastBee up to and including 2.1.0 lets a remote attacker who holds a high-privilege account submit crafted script content through /iot/script and have it executed by the platform, producing limited confidentiality, integrity and availability impact. The CVSS 4.0 base score is 5.1, and the CVSS 3.1 assessment places it at PR:H, so exploitation is confined to authorized operators or attackers who have already obtained privileged credentials. A vendor fix is available as the Gitee commit 890a33846005a937a58cccd738b7fb9821b82ea9; no public exploit code and no confirmed active exploitation are identified at time of analysis.
Insecure direct object reference (IDOR) in FastBee through 2.1.0 allows authenticated low-privilege users-including self-registered accounts-to read, overwrite, reassign device associations of, or delete other users' device groups by supplying sequential group IDs, because GroupController queries omit owner/tenant checks. This is a moderate-severity authorization flaw (CVSS 5.3) confined to device-group objects, with no code execution or full account takeover. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting (XSS) in kerwincui FastBee up to version 1.2.1 allows authenticated remote attackers to inject malicious scripts via the noticeContent parameter in the System Notice Handler component, which are then executed in the browsers of other users viewing notices. The vulnerability requires user interaction (victims must view the injected notice) and authenticated access, limiting immediate attack scope, though publicly available exploit code and vendor non-responsiveness increase real-world risk.
Path traversal vulnerability in kerwincui FastBee up to version 1.2.1 allows authenticated remote attackers to read arbitrary files on the server via manipulation of the fileName parameter in the ToolController.download endpoint. The vulnerability has publicly available exploit code and affects the Tool Download functionality, enabling unauthorized file disclosure with low CVSS impact (4.3) due to authentication requirements and limited scope.
Cross-tenant object reference flaw in FastBee through 2.1.0 lets any authenticated tenant user read another tenant's MQTT account, password and secret values, and overwrite or delete foreign product records, by supplying or enumerating sequential product IDs. The by-ID endpoints in ProductController enforced only RuoYi permission strings and omitted the tenant-ownership scoping that the list query applies at the service layer, which yields high confidentiality and integrity impact with limited availability impact (reported CVSS 4.0 score 8.7; independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L). Exploitation requires a valid tenant account on a multi-tenant deployment where other tenants' products exist, and no public exploit code or active exploitation was identified at time of analysis.
Code injection in the Groovy Script Executor component of beecue FastBee up to and including 2.1.0 lets a remote attacker who holds a high-privilege account submit crafted script content through /iot/script and have it executed by the platform, producing limited confidentiality, integrity and availability impact. The CVSS 4.0 base score is 5.1, and the CVSS 3.1 assessment places it at PR:H, so exploitation is confined to authorized operators or attackers who have already obtained privileged credentials. A vendor fix is available as the Gitee commit 890a33846005a937a58cccd738b7fb9821b82ea9; no public exploit code and no confirmed active exploitation are identified at time of analysis.
Insecure direct object reference (IDOR) in FastBee through 2.1.0 allows authenticated low-privilege users-including self-registered accounts-to read, overwrite, reassign device associations of, or delete other users' device groups by supplying sequential group IDs, because GroupController queries omit owner/tenant checks. This is a moderate-severity authorization flaw (CVSS 5.3) confined to device-group objects, with no code execution or full account takeover. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting (XSS) in kerwincui FastBee up to version 1.2.1 allows authenticated remote attackers to inject malicious scripts via the noticeContent parameter in the System Notice Handler component, which are then executed in the browsers of other users viewing notices. The vulnerability requires user interaction (victims must view the injected notice) and authenticated access, limiting immediate attack scope, though publicly available exploit code and vendor non-responsiveness increase real-world risk.
Path traversal vulnerability in kerwincui FastBee up to version 1.2.1 allows authenticated remote attackers to read arbitrary files on the server via manipulation of the fileName parameter in the ToolController.download endpoint. The vulnerability has publicly available exploit code and affects the Tool Download functionality, enabling unauthorized file disclosure with low CVSS impact (4.3) due to authentication requirements and limited scope.