The BlobStorageController in IoTSharp lacks the [Authorize] attribute that is applied to other controllers, and no global authorization FallbackPolicy is configured, leaving its Upload, Download, List, Modify, and Delete endpoints reachable by unauthenticated remote attackers. The controller allows unauthenticated users to access its file management endpoints, enabling them to upload arbitrary files or invoke download and delete actions to manipulate the server's file system. This can lead to code execution if a malicious payload is uploaded and executed. The vulnerability aligns with CWE-306, a missing authentication requirement.

The affected product is IoTSharp by IoTSharp. No specific patch level or version is listed, so any instance that includes the BlobStorageController without proper authorization is vulnerable.

With a CVSS score of 9.8, this vulnerability is considered critical. The EPSS score of 0.00613 indicates a very low but nonzero probability that an attacker will exploit this flaw, yet the lack of authentication means a remote attacker can exploit it easily over the network. The vulnerability is not yet listed in the CISA KEV catalog, but the combination of high severity and ease of exploitation results in a high risk to any exposed IoTSharp deployment.