FastBee: Insecure direct object reference in device endpoints
Summary
FastBee up to and including 2.1.0 does not check device ownership in its DeviceController endpoints. An authenticated low-privilege user can access devices by sequential deviceId or serialNumber values and read owner, IP and location data of other tenants. The same user can overwrite user_id and tenant_id to take over devices. The attack requires a valid account, which self-registration can provide.
Affected
- FastBee up to and including 2.1.0 (per CNA record: affected 0 to <= 2.1.0)
- Older branches (for example v1.2.1) contain the same DeviceController code; their status is not verified.
Fixed in
Unknown. No fixed version has been published.
Workaround
- No vendor mitigation published.
- Disable self-registration or allow only trusted accounts.
- Restrict access to the FastBee web and API interface to VPN or internal networks.
Exploitation
- The CNA's CISA SSVC assessment lists exploitation as 'poc' and automatable as 'no'.
- VulDB states that no exploit is available.
- A third-party write-up exists.
- No reports of exploitation in the wild are known.
Our recommendation
- Check whether any FastBee instance is internet-facing and whether self-registration is enabled.
- Restrict access to trusted networks or VPN until a vendor fix is available.
- Review device records for unexpected changes to owner and tenant fields.
- Monitor device endpoint logs for sequential ID enumeration.
- Check the kerwincui GitHub repository for a fix or advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record references: FastBee v2.1.0 DeviceServiceImpl github.com
- CVE record references: FastBee v2.1.0 DeviceController github.com
- CVE record references: FastBee v1.2.1 DeviceController github.com
- VulnCheck advisory www.vulncheck.com
- Third-party write-up (HackMD) hackmd.io
- VulDB entry vuldb.com
- OSV entry osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:26.
Original description (NVD)
FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify other tenants' devices by supplying sequential device IDs. Self-registered attackers can enumerate deviceId or serialNumber values to read owner, IP, and location data, and overwrite user_id and tenant_id to take over devices.
NVD references (6)
- https://github.com/kerwincui/FastBee/blob/v1.2.1/springboot/wumei-iot/src/main/java/com/ruoyi/iot/controller/…
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-open-api/src/main/java/com/fastbee/data/c…
- https://github.com/kerwincui/FastBee/blob/v2.1.0/springboot/fastbee-service/fastbee-iot-service/src/main/java…
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fastbee-device-ownership-idor
- https://www.vulncheck.com/advisories/fastbee-through-2.1.0-idor-via-devicecontroller-iot-device-endpoints
- https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/fastbee-device-ownership-idor
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.