PT-2026-24471 · Unknown · Nerves-Hub Nerves Hub Web

Joshk · CVE-2026-28806 · Published 2026-03-10 · Updated 2026-05-27

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions nerves-hub nerves hub web versions 1.0.0 through 2.3.9

Description An improper authorization issue exists in nerves-hub nerves hub web that allows cross-organization device control through device bulk actions and the device update API. Missing authorization checks in the device bulk actions and device update API endpoints permit authenticated users to target devices belonging to other organizations and perform actions beyond their authorized access level. An attacker can manipulate device identifiers to select devices outside of their organization and perform management actions, potentially interfering with firmware updates, accessing device functionality, or disrupting device connectivity. In environments with remote console access enabled, this could lead to full compromise of affected devices.

Recommendations Update nerves-hub nerves hub web to version 2.4.0 or later.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Improper Authorization

Weakness Enumeration

CWE-668

CWE-285

Related Identifiers

CVE-2026-28806

GHSA-F8FR-MCCC-XVCX

Affected Products

Nerves-Hub Nerves Hub Web

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/28xxx/CVE-2026-28806.json · Exploit
• https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-f8fr-mccc-xvcx · Vendor Advisory
• https://github.com/nerves-hub/nerves_hub_web/commit/1f69c9d595684a4650c3ac702f3dc7c5bcd7526c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-28806 · Security Note
• https://cna.erlef.org/cves/CVE-2026-28806.html · Patch
• https://osv.dev/vulnerability/CVE-2026-28806 · Vendor Advisory
• https://github.com/nerves-hub/nerves_hub_web · Note
• https://twitter.com/0dayPublishing/status/2031484980270972930 · Twitter Post
• https://twitter.com/CVEnew/status/2031504077792690665 · Twitter Post
• ❌ https://github.com/nerves-hub/nerves_hub_web.git · Note, Deleted
• https://twitter.com/dailycve/status/2059657248280887364 · Twitter Post
• https://osv.dev/vulnerability/EEF-CVE-2026-28806 · Vendor Advisory, Patch
• https://t.me/cveNotify/164833 · Telegram Post
• https://ghcr.io · Note
• https://github.com · Note