This brief is concerned with the attack estimation problem for cyber-physical systems (CPSs) under false data injection (FDI) attacks, where both of sensor attacks and actuator attacks are taken into consideration. Different from the existing methods such as brute force search or convex relaxation, an intermediate-variable-based estimation method is developed to estimate the FDI attacks occurring at the sensor and actuator, where the developed method has low computational complexity and high scalability. Notice that the estimator gain is obtained by establishing convex optimization problems that can be easily solved by using the standard software, and a stability condition for the desired intermediate estimator is also derived. Finally, an illustrative example is used to show the effectiveness of the proposed method.