CVE-2026-82452: fallo crítico en iot-ecology rust-iot-platform
rust-iot-platform Authentication Bypass via Missing Request Guards
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
28Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 9.3epss 0.8%
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
iot-ecology · rust-iot-platformCVEs relacionadas — iot-ecology rust-iot-platform
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-71278CRITICALrust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script EvaluationEPSS 0.7%CVE-2026-82453HIGHrust-iot-platform Cleartext Password Storage via User ModelEPSS 0.5%CVE-2026-71277CRITICALrust-iot-platform Authentication Bypass via Non-Validated Authorization HeaderEPSS 0.4%