rust-iot-platform CVE-2026-82453

Per the CVSS 4.0 vector (PR:N/UI:N/AV:N/AC:L/AT:N), no authentication, user interaction, or special configuration is required - exploitation is possible against a default-configured deployment accessible over the network. The specific routes are the user retrieval and listing API endpoints exposed by rust-iot-platform, which per PR:N appear accessible without credentials. Exploitation is limited to deployments that are network-reachable to the attacker; instances deployed exclusively on isolated internal networks without external exposure reduce reachability. The platform's IoT context means deployments may be internet-facing by design. Note: the PR:N assessment should be verified in each specific deployment, as individual configurations could add authentication middleware in front of these routes - if so, PR:L or PR:H would apply and risk would be reduced to insider or low-privilege attacker scenarios.

The CVSS 4.0 score of 8.7 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H reflects a high-confidence assessment of easy, unauthenticated network exploitation with full credential exposure. No EPSS data was provided, limiting probabilistic exploitation forecasting. No KEV listing exists and no public POC has been identified, suggesting exploitation has not yet been observed at scale - but the barrier to exploitation is extremely low (a standard HTTP GET request), so the absence of a POC is not a meaningful protective factor. The SSVC exploitation signal is 'none reported' but the attack is trivially automatable (AC:L/AT:N/PR:N/UI:N), meaning any scanning campaign could exploit this at scale. The primary risk multiplier is credential reuse: plaintext passwords recovered from this API can be replayed against email, cloud services, or other IoT infrastructure. One tension worth flagging: the PR:N rating implies user listing routes require no authentication, which is architecturally unusual - defenders should verify whether these routes enforce session tokens or API keys in their specific deployment, as misconfiguration or default-open settings may vary.

An unauthenticated attacker sends an HTTP GET request to the rust-iot-platform user listing endpoint, receives a JSON response containing all registered user accounts with their plaintext passwords, and immediately possesses valid credentials for every account on the platform. The attacker then attempts credential stuffing against external services - email providers, cloud consoles, or other IoT management portals - exploiting password reuse common in IoT deployment contexts. No tooling beyond a standard HTTP client (curl, browser) is required.