The rust-iot-platform contains a security flaw where the POST /calc-rule/create endpoint allows unauthenticated users to create a "calc rule" with arbitrary fields. This endpoint lacks the AuthToken request guard used elsewhere, enabling unauthenticated access. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code), indicating potential for code injection or execution. The CVSS 3.1 score is 9.8 (critical) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker can exploit this vulnerability remotely without authentication to create arbitrary calculation rules, potentially leading to arbitrary code execution or other severe impacts on system confidentiality, integrity, and availability. This could allow full system compromise or disruption of the rust-iot-platform service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary mitigation has been published at this time. Until a patch is available, restrict access to the vulnerable endpoint if possible or implement additional authentication controls externally.