# CVE-2026-82453

## Summary

- **CVE ID:** CVE-2026-82453
- **Severity:** HIGH
- **CVSS Score:** 8.7 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)
- **CWE:** CWE-256
- **Published:** Aug 29, 2026
- **Last Modified:** Aug 31, 2026

## Description

rust-iot-platform through commit 5df942ab stores user passwords in cleartext without hashing in the user model. Attackers can read API responses from user retrieval and listing routes to obtain plaintext credentials for all accounts.

## Affected Products

- iot-ecology — rust-iot-platform (0)

## References

- [CNA](https://github.com/iot-ecology/rust-iot-platform/blob/5df942ab6bc46a3bf83dbee8c7970554f92c972d/api/src/biz/user_biz.rs)
- [CNA](https://github.com/iot-ecology/rust-iot-platform)
- [CNA](https://www.vulncheck.com/advisories/rust-iot-platform-cleartext-password-storage-via-user-model)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.28%
- **EPSS Percentile:** 20.7

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._