An unauthenticated remote code execution vulnerability in rust-iot-platform allows attackers to execute malicious JavaScript within the server process.

This vulnerability is a Code Injection (CWE-94) flaw where the application fails to perform an authentication check on the POST /calc-rule/create endpoint. An unauthenticated attacker can inject arbitrary JavaScript into a calc rule that the system subsequently executes without sandboxing.

The ability for an unauthenticated attacker to execute arbitrary code on the server carries a critical risk of full system compromise. With a CVSS score of 9.8, this flaw could lead to complete data exfiltration, unauthorized modification of IoT configurations, or total service disruption, severely impacting business operations and data integrity.

Immediate Action: Upgrade to the latest available version of rust-iot-platform immediately as provided by the vendor. If a patch is not yet available, restrict network access to the API endpoints to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /calc-rule/create endpoint. Monitor server processes for unexpected child tasks or unusual resource consumption patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the calc-rule management API.

Public Exploit Available: false

This is a critical vulnerability that requires immediate attention due to the lack of authentication required for exploitation. Administrators must prioritize the application of vendor-supplied updates to neutralize the risk of unauthorized remote code execution.