{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3afastbeefastbee/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:fastbee:fastbee:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-110124"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["FastBee (\u003c= 2.1.0)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","idor","cve-2026-110124"],"_cs_type":"advisory","_cs_vendors":["FastBee"],"content_html":"\u003cp\u003eFastBee versions 2.1.0 and earlier are affected by an insecure direct object reference (IDOR) vulnerability located within the DeviceController component. This vulnerability stems from improper authorization checks when handling requests directed at specific device identifiers. An authenticated user with low privileges can exploit this by manipulating the deviceId or serialNumber parameters in API requests. By supplying sequential or brute-forced identifiers, an attacker can bypass access controls to view sensitive information including device owner details, IP addresses, and physical locations. Furthermore, the vulnerability allows unauthorized modification of device associations, where an attacker can overwrite user_id and tenant_id fields to assume control over devices belonging to other tenants within the platform. Given the high CVSS base score of 8.1, this vulnerability poses a significant risk of data exfiltration and cross-tenant device hijacking in multi-tenant environments.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker authenticates to the FastBee platform using a legitimate, low-privileged user account.\u003c/li\u003e\n\u003cli\u003eAttacker performs discovery to identify the API endpoints associated with DeviceController.\u003c/li\u003e\n\u003cli\u003eAttacker captures an API request intended to retrieve details for their own device.\u003c/li\u003e\n\u003cli\u003eAttacker modifies the request parameters (e.g., deviceId or serialNumber) to target IDs outside their assigned tenant scope.\u003c/li\u003e\n\u003cli\u003eAttacker iterates through sequential or guessed identifiers to enumerate available devices in the platform.\u003c/li\u003e\n\u003cli\u003eAttacker observes sensitive device metadata, such as IP addresses and owner info, returned in the API responses.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a PUT/POST request with malicious user_id and tenant_id values to associate a target device with their own account.\u003c/li\u003e\n\u003cli\u003eAttacker successfully gains full control over the target device, effectively hijacking the asset from the original owner.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows for unauthorized access to sensitive telemetry data and complete takeover of IoT device management. In a multi-tenant environment, this leads to cross-tenant data leakage and the loss of administrative control over devices, potentially affecting any organization using FastBee deployments. The scope of impact includes unauthorized surveillance of device locations and the potential for persistent control over third-party hardware.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for addressing CVE-2026-110124:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately upgrade all FastBee instances to a version beyond 2.1.0 that includes the vendor-provided patch.\u003c/li\u003e\n\u003cli\u003eAudit webserver access logs for anomalous API request patterns, specifically searching for successful responses (HTTP 200) following a series of incrementing or high-frequency deviceId parameter values.\u003c/li\u003e\n\u003cli\u003eImplement strict authorization checks at the application controller layer to ensure that the currently authenticated user session has explicit permissions to access or modify the requested resource ID.\u003c/li\u003e\n\u003cli\u003eMonitor for unexpected spikes in device reassignment events within the DeviceController service logs.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-13T18:38:00Z","date_published":"2026-10-13T18:38:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-fastbee-idor/","summary":"An insecure direct object reference vulnerability in FastBee versions through 2.1.0 allows authenticated low-privileged users to access and modify devices belonging to other tenants.","title":"IDOR Vulnerability in FastBee DeviceController","url":"https://feed.craftedsignal.io/briefs/2026-10-fastbee-idor/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:fastbee:fastbee:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}