The vulnerability is an improper authorization bug that lets an authenticated user perform bulk device actions or update commands on devices that belong to another organization. Because the API fails to verify that the caller has permission for each target device, the attacker can manipulate device identifiers to select devices outside their own organization. The resulting impact includes moving devices between products the attacker controls, tampering with firmware updates, and potentially enabling downstream attacks such as remote console access, which could lead to full device compromise.

The issue affects Nerves Hub's web application, versions from 1.0.0 up to (but not including) 2.4.0. The affected product is nerves_hub_web, maintained by the Nerves Hub project.

The CVSS score of 9.4 indicates a critical severity, while the EPSS score of less than 1% suggests low probability of exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. An attacker would need valid credentials to a Nerves Hub account and would exploit the API endpoints for bulk actions or device updates. Once authenticated, the absence of per‑device authorization checks allows arbitrary manipulation of any device across organizational boundaries.