The BlobStorageController in IoTSharp lacks the required authentication checks that other controllers have, exposing Upload, Download, List, Modify, and Delete endpoints to unauthenticated users. Because the controller uses the supplied path and filename parameters directly in file system operations without sanitization, attackers can perform path traversal to read, write, modify, or delete arbitrary files on the host, including files in web‑accessible directories. This flaw can be leveraged to upload a web shell and execute code remotely, a classic remote code execution scenario. The weakness falls under CWE‑306, a missing authentication requirement.

The affected product is IoTSharp by IoTSharp. No specific patch level or version is listed, so any instance that includes the BlobStorageController without proper authorization is vulnerable.

With a CVSS score of 9.8, this vulnerability is considered critical. Although the EPSS score is unavailable, the lack of authentication and path traversal means a remote attacker can exploit it easily over the network. The vulnerability is not yet listed in the CISA KEV catalog, but the combination of high severity and ease of exploitation results in a high risk to any exposed IoTSharp deployment.