CVE-2026-82453

8.7 highEPSS 0.5%

High (8.7). EPSS 0.5% chance of exploitation in the next 30 days.

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

Severity

CVSS 4.0

8.7 high

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE: CWE-256
Published: 2026-08-29
Modified: 2026-09-23
Record from: the NVD, synced 2026-10-19

References

https://github.com/iot-ecology/rust-iot-platform
https://github.com/iot-ecology/rust-iot-platform/blob/5df942ab6bc46a3bf83dbee8c7970554f92c972d/api/src/biz/user_biz.rs
https://www.vulncheck.com/advisories/rust-iot-platform-cleartext-password-storage-via-user-model

Check your stack JSON