CVE-2026-7677
LowCVSS 3.5Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
A vulnerability was determined in kerwincui FastBee up to 1.2.1 in the Add function of SysNoticeController.java within the System Notice Handler. Manipulating the noticeContent argument causes cross-site scripting. The attack can be initiated remotely, the exploit has been publicly disclosed and may be utilized, and the vendor did not respond.
Risk Assessment
The XSS vulnerability may allow script execution in a user's browser, potentially leading to session hijacking or data theft. The vendor's lack of response means a fix may not be available.
Recommendation
Implement input validation and encoding in the application and consider restricting access to the notice functionality. Monitor the vendor for patches.
Other vulnerabilities in FastBee
See all- CVE-2026-120274Medium
A vulnerability was identified in beecue FastBee up to version 2.1.0. An unknown functionality of the /iot/script file in the Groovy Script Executor component allows code injection. The attack can be carried out remotely, and a patch is available under identifier 890a33846005a937a58cccd738b7fb9821b82ea9.
- CVE-2026-111654Medium
FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access other users' device groups because GroupController queries lack owner checks. Attackers, including self-registered users, can supply sequential group IDs to read, overwrite, reassign, rewrite device associations of, or delete other users' groups.
- CVE-2026-110124High
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs.
- CVE-2026-7676Medium
In kerwincui FastBee up to 1.2.1, the ToolController.download function in ToolController.java of the Tool Download Endpoint component, when manipulating the fileName argument, leads to path traversal. The attack can be performed remotely and the exploit has been publicly disclosed. The vendor did not respond to the disclosure.
Original NVD description (English source)
A vulnerability was determined in kerwincui FastBee up to 1.2.1. The impacted element is the function Add of the file springboot/fastbee-admin/src/main/java/com/fastbee/web/controller/system/SysNoticeController.java of the component System Notice Handler. This manipulation of the argument noticeContent causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS