8.7
CVSS 4.0
Няма данни
Вероятност да бъде експлоатирана в следващите 30 дни (EPSS)
Няма потвърждение
Атакува се
Няма данни
Време до експлоатация
Атакува се по мрежата, без особени условия, с обикновен потребителски вход и без действие от потребителя.
- Експлоатация: няма данни за експлоатация
- Атаката не може да се автоматизира
Описание
Оригинално описание
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.
Засегнати продукти
- beecue FastBee: до 2.1.0
Вид слабост
История
- 3 ноември 2026 Публикувано
Други уязвимости в beecue FastBee
Първоизточници
- https://www.cve.org/CVERecord?id=CVE-2026-121556
- https://nvd.nist.gov/vuln/detail/CVE-2026-121556
- https://github.com/beecue/FastBee/issues/32
- https://github.com/kerwincui/FastBee
- https://github.com/beecue/FastBee/commit/3393e3223965a9dc9682dfb2bd37635fffa0fbd2
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/controller/ProductController.java#L77-L141
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java/com/fastbee/iot/service/impl/ProductServiceImpl.java#L72-L92
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/resources/mapper/iot/ProductMapper.xml#L37-L67
- https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-iot-product-by-id-endpoints