CVE-2026-82453
rust-iot-platform Cleartext Password Storage via User Model
- State
- Published
- Severity
- 8.7 High
- Published
- Aug 29, 2026
- Updated
- Sep 24, 2026
- Reserved
- Aug 29, 2026
Description
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-256 Plaintext Storage of a Password
Affected Products
| Product | Versions |
|---|---|
rust-iot-platformiot-ecology |
|
References
- Vulnerable code: user_biz.rs (cleartext password comparison)technical-description
- https://github.com/iot-ecology/rust-iot-platformproduct
- VulnCheck Advisory: rust-iot-platform Cleartext Password Storage via User Modelthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.