A critical vulnerability in the rust-iot-platform allows unauthenticated attackers to retrieve all user credentials in plaintext, posing a severe risk of total system compromise.

The application suffers from improper storage of credentials (CWE-256) where user passwords are saved in the database without hashing. This flaw is exposed via unauthenticated API routes used for user retrieval and listing, allowing anyone with network access to the API to extract plaintext credentials.

The exposure of plaintext credentials constitutes a complete loss of confidentiality for all user accounts within the platform. Given the CVSS score of 7.5, this high-severity vulnerability could lead to widespread unauthorized access, potential lateral movement into connected IoT infrastructure, and significant reputational damage. The ability for an unauthenticated user to dump the entire user database necessitates immediate intervention.

Immediate Action: Since no specific patch version is documented, administrators must restrict access to the affected API endpoints at the network level and initiate a mandatory password reset for all users once the code is secured. Developers should implement strong, salted password hashing (such as Argon2 or bcrypt) within the UserBiz logic immediately.

Proactive Monitoring: Review application access logs for unusual patterns of requests targeting user retrieval or listing endpoints. Monitor database activity for unauthorized queries that could indicate an attempt to dump the user table.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block requests to sensitive user-related API endpoints from unauthorized IP addresses. Ensure the backend database is isolated from the public internet and limit application service account permissions to the minimum required level.

Public Exploit Available: No.

The severity of this vulnerability cannot be overstated, as it provides attackers with the keys to the entire platform. Organizations running the affected versions must prioritize securing these API endpoints immediately. Until a formal patch is applied, treat all existing credentials as compromised and prepare for a comprehensive platform-wide security audit.