CVE-2026-110124
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs.
Risk Assessment
The risk includes unauthorized access to device data (owner, IP, location) and potential device takeover by overwriting user_id and tenant_id, potentially compromising integrity and confidentiality.
Recommendation
Upgrade FastBee to a fixed version and implement authorization-based access controls for device operations.
Other vulnerabilities in FastBee
Original NVD description (English source)
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS