EUVD-2026-68107
GHSA-hc3c-8h8r-vcg7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessDiscover exposed rust-iot-platform API
-
DeliverySend unauthenticated request to user route
-
ExploitBypass missing request guard
-
ExecutionEnumerate and modify user accounts
-
ImpactCreate attacker admin / delete users
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The only prerequisite is network reachability of the platform's REST API - specifically the unprotected user-management routes in user_router.rs - with no credentials, tokens, or user interaction required (CVSS PR:N/UI:N/AC:L). The vulnerability is present in default deployments running the vulnerable code (through commit 5df942ab), since the guards are simply absent from the handler signatures rather than disabled by configuration. The practical limiting factor is exposure: exploitation requires that the attacker can reach the API endpoint, so instances confined to isolated management networks or behind an authenticating proxy are not directly exploitable, and the platform's small deployment base narrows real-world attack surface. |
| Impact | The signals are internally consistent and point to genuine high severity: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes trivial, network-reachable, unauthenticated exploitation with high impact on confidentiality, integrity, and availability of the user store, and CWE-306 aligns exactly with the description. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active or automated exploitation yet - the elevated score reflects ease and impact, not observed attacks. The tempering factor is deployment footprint rather than difficulty: this is a small open-source project, so absolute exposure is limited even though any exposed instance is at severe risk, and any operator running an internet-facing instance should treat it as urgent and patch or restrict access immediately. Note the input identifies a specific vulnerable commit but no fixed release, so remediation timing is the main open question. |
| Exploit ScenarioDerived | An attacker scans for exposed rust-iot-platform instances and sends a direct HTTP request to a user-management endpoint (e.g., a create-user route) with no credentials. Because the handler lacks a request guard, the platform processes it, letting the attacker enumerate and exfiltrate existing accounts, create a new privileged account, or delete legitimate users. Given AV:N/AC:L/PR:N/UI:N, this requires only network reachability and no authentication or user interaction; no public POC is currently identified. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 29, 2026
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpoints because most REST API handlers omit request guards, letting remote unauthenticated attackers create, read, modify, and delete user accounts. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw grants full CRUD over the identity store with no credentials. No public exploit code has been identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
No vendor-released patch version is identified at time of analysis; the references point to the vulnerable source and the VulnCheck advisory rather than a tagged fixed release. Operators should update to a build later than commit 5df942ab that adds authentication guards to the user_router and other API handlers, tracking the upstream repository (https://github.com/iot-ecology/rust-iot-platform) and the VulnCheck advisory (https://www.vulncheck.com/advisories/rust-iot-platform-authentication-bypass-via-missing-request-guards) for a fixed commit. Until a fix is confirmed, compensating controls include placing the API behind an authenticating reverse proxy or API gateway that enforces credentials on all /user routes (side effect: legitimate clients must be reconfigured for the proxy auth), network-restricting the API to a management VLAN or allowlisted admin IPs (side effect: breaks remote/mobile access), and disabling or firewall-blocking the user-management endpoints if they are not required (side effect: loss of remote account administration). Avoid exposing the instance directly to the internet in any case.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is a Rust-based IoT management platform whose HTTP API is built around per-route handler functions (see api/src/controller/user_router.rs). In frameworks like Actix-web or Axum, authentication is typically enforced by including an extractor/guard (e.g., an authenticated-user or session extractor) in the handler signature or by wrapping routes in middleware; when that guard is absent from the signature, the route is served to anyone who can reach it. This is a textbook CWE-306 (Missing Authentication for a Critical Function): the critical function here is user-account management, which is left reachable without any credential check. The single affected package is identified by cpe:2.3:a:iot-ecology:rust-iot-platform:*:*:*:*:*:*:*:* at the vulnerable commit.
Know when Rust Iot Platform gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Remote, low-complexity, unauthenticated (PR:N/UI:N) access to unguarded user-CRUD endpoints yields full account read/modify/delete, so C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
Executive ViewAI
iot-ecology's rust-iot-platform contains an authentication bypass allowing remote attackers to fully compromise user accounts (create, read, modify, delete) without credentials; no public exploit identified at time of analysis, but the vulnerability is trivially exploitable. All users of systems relying on this platform face immediate risk of account takeover and unauthorized access. With no vendor patch currently available, urgent interim controls are required to prevent account-level security breaches.
No vendor-released patch identified at time of analysis. Interim mitigations: implement network segmentation to restrict platform access to trusted networks only; deploy WAF or API gateway controls to monitor and block anomalous account CRUD requests; maintain detailed logging and alerting on account management operations; preserve database snapshots to detect unauthorized modifications; schedule immediate credential rotation for all critical and administrative accounts; if feasible, temporarily disable non-critical account management features; consider isolating affected systems from production environments until patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Rust Iot Platform
View allUnauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in
Authentication bypass in iot-ecology's rust-iot-platform lets any remote attacker reach every endpoint guarded by the Au
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to h
Exploit-DB