CVE-2026-28806
Improper Authorization in nerves_hub_web Enables Cross-Org Device Control
Publication date: 2026-03-10
Last updated on: 2026-04-06
Assigner: EEF
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nerves_hub_web | nerves_hub_web | From 1.0.0 (inc) to 2.4.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-285 | The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. |
| CWE-668 | The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper authorization issue in the nerves-hub nerves_hub_web application. It allows authenticated users to control devices that belong to other organizations by exploiting missing authorization checks in the device bulk actions and device update API endpoints.
Attackers can manipulate device identifiers to select devices outside their organization and perform management actions on them, such as moving devices to products they control. This can interfere with firmware updates, access device functionality, or disrupt device connectivity.
In environments with additional features like remote console access, this vulnerability could lead to full compromise of the affected devices.
How can this vulnerability impact me? :
This vulnerability can have serious impacts including unauthorized control over devices belonging to other organizations.
- Attackers can interfere with firmware updates, potentially causing devices to run malicious or outdated software.
- Attackers may access device functionality exposed by the platform, leading to unauthorized operations.
- Device connectivity can be disrupted, affecting the availability and reliability of the devices.
- In cases where remote console access is enabled, attackers could fully compromise affected devices.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
I don't know