This vulnerability in nerves_hub_web arises from missing authorization checks in device bulk actions and device update API endpoints. Authenticated users can exploit this by selecting and managing devices belonging to other organizations, performing unauthorized actions such as reassigning devices to different products. The flaw enables cross-organization device control, potentially impacting device management, firmware updates, and connectivity. The issue affects versions from 1.0.0 up to but not including 2.4.0.

Exploitation allows attackers with authenticated access to control devices outside their organization, potentially disrupting device operations, interfering with firmware updates, and accessing device functionality. If remote console access is enabled, attackers may achieve full device compromise. This represents a critical security risk to device integrity and operational continuity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict authenticated user privileges carefully and avoid enabling additional features like remote console access that increase risk.