What is the CVSS score of CVE-2026-71262?

CVE-2026-71262 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.6%.

Which versions of IoTSharp are affected by CVE-2026-71262?

IoTSharp blob storage endpoints lack authentication controls, permitting unauthenticated attackers to read, modify, and delete arbitrary server files and deploy webshells for remote code execution.

How to fix or mitigate CVE-2026-71262?

Within 24 hours: immediately inventory all IoTSharp instances in your environment and confirm internet exposure; apply firewall rules or VPN-gating to restrict blob storage access to authorized networks only. Within 7 days: deploy a reverse proxy with authentication (nginx, HAProxy, or cloud WAF) in front of IoTSharp's blob endpoints, or disable blob storage functionality if operationally feasible. Within 30 days: contact IoTSharp vendor for security patch timeline; if no patch is provided within 90 days, plan migration to alternative products; conduct file integrity audit on affected servers to identify unauthorized modifications, webshells, or persistence mechanisms.

IoTSharp CVE-2026-71262

EUVD-2026-53347 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-08-05 TuranSec

GHSA-p2pj-7344-wr5m

Authentication Bypass RCE Path Traversal Iotsharp

9.8

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Endpoints are unauthenticated and network-reachable by default (PR:N/AV:N/AC:L), and unsanitized file write yields arbitrary read/write/delete plus RCE, giving full C:H/I:H/A:H.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:32 vuln.today

CVE Published

Aug 05, 2026 - 12:26 cve.org

CRITICAL 9.8

DescriptionCVE.org

IoTSharp BlobStorageController.cs lacks the [Authorize] attribute applied to every other controller in the application (DevicesController, CustomersController, TenantsController, etc.), and no global authorization FallbackPolicy is configured in Startup.cs, leaving its Upload/Download/List/Modify/Delete endpoints reachable by unauthenticated remote attackers. The path/filename parameters passed to these endpoints (e.g. _blob.WriteFileAsync($"{path}/{formFile.FileName}", ...)) are used without sanitization, enabling path traversal that allows writing, reading, modifying, and deleting arbitrary files outside the intended blob storage directory, including web-accessible paths that can be leveraged for remote code execution via webshell upload.

AnalysisAI

Missing authentication in IoTSharp's BlobStorageController lets unauthenticated remote attackers reach Upload, Download, List, Modify, and Delete blob endpoints that every other controller (Devices, Customers, Tenants) guards with [Authorize]. Because the path and filename parameters are written to disk without sanitization, attackers can traverse outside the blob directory to read, alter, or delete arbitrary files - and drop a webshell into a web-accessible path for remote code execution. No public exploit identified at time of analysis, but the combination of unauthenticated access and a clear RCE path makes this trivially weaponizable.

Technical ContextAI

IoTSharp is an open-source ASP.NET Core IoT platform for device connectivity, telemetry storage, and rules processing. Authorization in ASP.NET Core is typically applied per-controller via the [Authorize] attribute or globally via an authorization FallbackPolicy registered in Startup.cs; this vulnerability is a two-part failure of both mechanisms - the attribute is absent on BlobStorageController and no FallbackPolicy backstops it, so the endpoints default to anonymous access. This is the textbook CWE-306 (Missing Authentication for Critical Function) root cause. The impact is amplified by an unsanitized file write (_blob.WriteFileAsync($"{path}/{formFile.FileName}", ...)), a classic path-traversal sink where attacker-controlled path/FileName values containing ../ sequences escape the intended blob storage root. CPE cpe:2.3:a:iotsharp:iotsharp identifies the single affected application.

RemediationAI

No vendor-released patch identified at time of analysis - the references point only to the repository and the vulnerable source file, not to a fix commit or tagged release. Apply immediate code-level mitigations: add the [Authorize] attribute to BlobStorageController (matching DevicesController/CustomersController/TenantsController) and, as defense in depth, register a global authorization FallbackPolicy in Startup.cs so unattributed endpoints deny anonymous access by default. Independently, sanitize the file-write sink - reject or canonicalize path and formFile.FileName values, strip ../ sequences, and enforce that the resolved absolute path stays within the intended blob storage root (side effect: legitimate nested paths must be validated against an allowlist). As compensating controls until code is fixed, place IoTSharp behind an authenticating reverse proxy or network ACL that blocks anonymous access to the /api/BlobStorage routes (trade-off: may break integrations that legitimately call these endpoints), and ensure the blob storage directory is not served from a web-executable path so an uploaded file cannot be executed. Track the upstream repository for an official fix and version.