Executive brief
NervesHub is a management platform for managing firmware updates and remote access for connected hardware devices. A security flaw in the platform's web interface allows an authorized user from one organization to gain control over devices belonging to a completely different organization. An attacker could use this to disrupt device connectivity, interfere with firmware updates, or potentially gain full remote console access to sensitive hardware.
Technical details
An improper authorization vulnerability exists in the device bulk actions and device update API endpoints of nerves_hub_web. The root cause is a failure to properly scope device lookups and authorization checks to the authenticated user's organization. An attacker with low-privileged credentials can manipulate device identifiers in API requests to target devices outside their own organization. Successful exploitation allows an attacker to move devices to products they control, disrupt firmware updates, or, if remote console features are enabled, achieve full compromise of the affected hardware. The issue is fixed in version 2.4.0.
Affected products
- nerves-hub nerves_hub_web 1.0.0 to 2.3.9
Timeline
- 2026-03-10: disclosed
- 2026-03-10: patched: Fixed in version 2.4.0
- 2026-03-10: advisory