rust‑iot‑platform allows an attacker with network access to create a calculation rule via the POST /calc‑rule/create endpoint, which is not protected by authentication. The route accepts an arbitrary script field. Based on the description, it is inferred that the script is evaluated without sandboxing, allowing an attacker to execute arbitrary JavaScript code with the privileges of the server process. This leads to total compromise of confidentiality, integrity, and availability.

All versions of rust‑iot‑platform deployed by iot‑ecology are potentially affected. The lack of authentication on the vulnerable endpoint means that any user with network access to the API can exploit it.

The CVSS score of 9.8 indicates that the vulnerability is critical, with a full impact if exploited. The EPSS score of 0.00488 (0.488%) indicates a very low probability of exploitation currently, but given the high CVSS score, the risk remains significant. The absence of a CISA KEV listing does not reduce the risk, as the vulnerability can be leveraged remotely through a simple POST request to /calc‑rule/create. The attacker does not need any privileges and can trigger the malicious script after rule creation, making exploitation straightforward for anyone with network reach to the API.