Executive brief
rust-iot-platform is an IoT development platform built with Rust that handles real-time data processing and multi-protocol communication for Internet of Things devices. An authentication bypass vulnerability allows attackers to create, modify, list, and delete user accounts without providing valid credentials, potentially giving unauthorized users full control over the platform and any connected IoT infrastructure.
Technical details
The vulnerability is an authentication bypass caused by missing authentication guards in REST API route handlers. Most endpoints in the user management API lack proper authentication middleware, allowing unauthenticated attackers to directly invoke protected operations. The affected routes enable creation, retrieval, listing, updating, and deletion of user accounts without credential validation. The vulnerability is accessible via network requests to the unprotected API endpoints, requiring no authentication, user interaction, or special preconditions. Attackers can fully compromise account management and gain administrative control over the IoT platform.
Affected products
- iot-ecology rust-iot-platform through commit 5df942ab
Timeline
- 2026-08-29: disclosed