| Title | 曲靖蜂信科技有限公司 FastBee v2.1.0 and earlier Code Injection |
|---|
| Description | The FastBee IoT platform (Gitee open-source version) contains a remote code execution vulnerability in its rule-engine script functionality (/iot/script). The platform uses Groovy as a dynamic script language, executed by the liteflow engine during device property-report and platform function-downlink flows. Script content is written through the management interface and hot-loaded into the script executor immediately upon save, without any sandboxing or dangerous-class whitelist. As a result, a crafted script reachable via an administrative session can directly invoke process, file, and reflection capabilities, leading to arbitrary command execution on the server. The execution chain is triggered by the device property-report and platform function-downlink handlers, which select and execute enabled scripts per product+event. Affected: FastBee v2.1.0 and prior versions (including commit 284b714). CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H ≈ 9.8 (with the admin default credential unmodified; if script editing is strictly limited to administrators, PR:H → ≈ 8.8). Fix recommendations: sandbox the script executor (restrict process/file/reflection access or adopt a restricted DSL), enforce default-credential and weak-password policies, add approval and audit to script changes, minimize script-editing privileges, and harden MQTT/WebSocket network exposure and credential management.
|
|---|
| Source | ⚠️ https://gitee.com/x0n1on/fastbee/issues/IKIU7D |
|---|
| User | 0n1on (UID 100116) |
|---|
| Submission | 09/28/2026 08:04 (1 month ago) |
|---|
| Moderation | 11/01/2026 08:35 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 429618 [beecue FastBee up to 2.1.0 Groovy Script Executor /iot/script code injection] |
|---|
| Points | 20 |
|---|