Critical Vulnerabilities in rust-iot-platform Expose User Data and Credentials

rust-iot-platform has two critical vulnerabilities, CVE-2026-82452 and CVE-2026-82453, published on 2026-08-29. CVE-2026-82452 allows attackers to manage user accounts without authentication, while CVE-2026-82453 exposes user passwords stored in plaintext. Both vulnerabilities affect all versions up to commit 5df942ab. Attackers can exploit these flaws through unprotected API endpoints, enabling full administrative control over user accounts and access to sensitive credentials. The platform's lack of authentication checks and outdated password storage practices pose significant risks, especially in IoT deployments across Latin America. Organizations using rust-iot-platform are urged to assess their exposure and implement necessary security measures. The vulnerabilities highlight systemic design flaws in the platform's API architecture.

Key Points: • CVE-2026-82452 allows unauthenticated user account management. • CVE-2026-82453 exposes user passwords in plaintext. • Both vulnerabilities affect all versions up to commit 5df942ab.