Description
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.
Published: 2026-08-29
Score: 8.7 High
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability in rust‑iot‑platform allows storage of user passwords in cleartext within the user model. Attackers who can access API responses from user retrieval and listing endpoints are able to directly read these passwords, compromising credential confidentiality. This weakness is identified as CWE‑256, a cleartext storage of sensitive data issue.

Affected Systems

The affected product is rust‑iot‑platform from iot‑ecology. Version information is not specified, so all releases of this product could be impacted until a patch is released.

Risk and Exploitability

The CVSS score of 8.7 classifies this flaw as critical in severity. The EPSS score is not available, indicating no quantitative exploit probability estimate. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote: an adversary with network access to the API endpoints could request user data and extract the plaintext passwords. No additional conditions such as privileges specified, suggesting that any user with API access, and potentially unauthenticated traffic, could exploit the flaw.

Generated by OpenCVE AI on August 29, 2026 at 15:22 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade rust‑iot‑platform to a version that implements password hashing or apply an official vendor patch
  • If a patch is not immediately available, restrict or disable the user retrieval and listing API routes to prevent exposure of credentials
  • Implement network segmentation and enforce client authentication for all API endpoints to reduce the attack surface

Generated by OpenCVE AI on August 29, 2026 at 15:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 29 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
First Time appeared Iot-ecology
Iot-ecology rust-iot-platform
Vendors & Products Iot-ecology
Iot-ecology rust-iot-platform

Sat, 29 Aug 2026 14:00:00 +0000

Type Values Removed Values Added
Description rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.
Title rust-iot-platform Cleartext Password Storage via User Model
Weaknesses CWE-256
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Iot-ecology Rust-iot-platform
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-08-29T13:47:55.410Z

Reserved: 2026-08-29T13:22:58.931Z

Link: CVE-2026-82453

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-29T14:16:38.347

Modified: 2026-08-29T14:16:38.347

Link: CVE-2026-82453

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-29T15:30:05Z

Weaknesses
  • CWE-256

    Plaintext Storage of a Password