Iot-ecology vulnerabilities
We track 4 vulnerabilities in Iot-ecology products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on August 29, 2026.
Latest Iot-ecology vulnerabilities
- 7.5 High severity
rust-iot-platform: Plaintext Storage of a Password
rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.
- 9.8 Critical severity
rust-iot-platform: Missing Authentication for Critical Functionality
rust-iot-platform through commit 5df942ab contains an authentication bypass vulnerability where most REST API routes lack authentication guards in their handler signatures. Unauthenticated attackers can create, update, list, retrieve, and delete user accounts
- 9.8 Critical severity
rust-iot-platform: Improper Control of Generation of Code
rust-iot-platform allows creating a "calc rule" via POST /calc-rule/create (api/src/controller/calc_rule_router.rs) containing an arbitrary field. This route does not take the AuthToken request guard used elsewhere in the application, making it reachable witho
- 9.1 Critical severity
rust-iot-platform: Improper Authentication
rust-iot-platform's AuthToken request-guard implementation (api/src/main.rs) only checks whether the Authorization HTTP header is present, and never validates its value against any session, token store, or signature. Any request carrying an arbitrary non-empty