Threat database

FastBee versions up to 2.1.0 have an insecure direct object reference vulnerability that allows authenticated low-privilege users to access and manipulate other users' device groups. This occurs because the GroupController does not verify ownership when querying groups. Attackers can read, overwrite, reassign, or delete device groups belonging to other users by supplying sequential group IDs.

FastBee versions up to 2.1.0 have an insecure direct object reference vulnerability in the DeviceController component. This flaw allows authenticated low-privilege users to access and modify devices belonging to other tenants by manipulating device identifiers. Attackers can enumerate device IDs or serial numbers to obtain sensitive information such as device owner, IP address, and location, and can overwrite user and tenant identifiers to take control of devices.

CVE-2026-7677 is a cross-site scripting (XSS) vulnerability in kerwincui FastBee versions up to 1.2.1. The issue exists in the Add function of the System Notice Handler component, specifically in the SysNoticeController.java file. This vulnerability allows remote attackers to manipulate the noticeContent argument to execute XSS attacks. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix. The CVSS 4.0 base score is 5.1, indicating a medium severity level.

A vulnerability was found in kerwincui FastBee up to 1.2.1. The affected element is the function ToolController.download of the file springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ToolController.java of the component Tool Download Endpoint. The manipulation of the argument fileName results in path traversal. The attack may be performed from remote. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.