CVE-2026-82453CWE-256

CVE-2026-82453

High · published August 29, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
39.4
In the wild
Unconfirmed
What it is

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00466 · 39.4th percentile
Weakness
CWE-256 · Plaintext Storage of a Password
Published
2026-08-29T18:16Z
References (3)
https://github.com/iot-ecology/rust-iot-platform · [email protected]https://github.com/iot-ecology/rust-iot-platform/blob/5df942ab6bc46a3bf83dbee8c7970554f92c972d/api/src/biz/user_biz.rs · [email protected]https://www.vulncheck.com/advisories/rust-iot-platform-cleartext-password-storage-via-user-model · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 29 AUG 13:47Z
    rust-iot-platform Cleartext Password Storage via User Model
    cvelistv5