CVE-2026-82452: falha crítica em iot-ecology rust-iot-platform
rust-iot-platform Authentication Bypass via Missing Request Guards
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.8%
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
iot-ecology · rust-iot-platformCVEs relacionadas — iot-ecology rust-iot-platform
No mesmo produto, das mais perigosas para as menos.
CVE-2026-71278CRITICALrust-iot-platform Unauthenticated Remote Code Execution via Unsandboxed Calc-Rule Script EvaluationEPSS 0.7%CVE-2026-82453HIGHrust-iot-platform Cleartext Password Storage via User ModelEPSS 0.5%CVE-2026-71277CRITICALrust-iot-platform Authentication Bypass via Non-Validated Authorization HeaderEPSS 0.4%