EUVD-2026-68107
GHSA-hc3c-8h8r-vcg7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote, low-complexity, unauthenticated (PR:N/UI:N) access to unguarded user-CRUD endpoints yields full account read/modify/delete, so C:H/I:H/A:H with unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts by directly accessing unprotected endpoints without providing valid credentials.
AnalysisAI
Authentication bypass in iot-ecology's rust-iot-platform (through commit 5df942ab) exposes user-account management endpoints because most REST API handlers omit request guards, letting remote unauthenticated attackers create, read, modify, and delete user accounts. Reported by VulnCheck with a CVSS 4.0 base score of 9.3, the flaw grants full CRUD over the identity store with no credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The only prerequisite is network reachability of the platform's REST API - specifically the unprotected user-management routes in user_router.rs - with no credentials, tokens, or user interaction required (CVSS PR:N/UI:N/AC:L). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are internally consistent and point to genuine high severity: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H) describes trivial, network-reachable, unauthenticated exploitation with high impact on confidentiality, integrity, and availability of the user store, and CWE-306 aligns exactly with the description. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified at time of analysis; the references point to the vulnerable source and the VulnCheck advisory rather than a tagged fixed release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: inventory all rust-iot-platform deployments at commit 5df942ab or earlier and identify which are network-accessible; if externally exposed or in sensitive environments, immediately implement network isolation through firewall rules or private VPC segmentation to deny remote access. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Rust Iot Platform
View allUnauthenticated remote code execution in iot-ecology's rust-iot-platform allows attackers to run arbitrary JavaScript in
Authentication bypass in iot-ecology's rust-iot-platform lets any remote attacker reach every endpoint guarded by the Au
Cleartext password storage in rust-iot-platform (through commit 5df942ab) enables unauthenticated network attackers to h
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today