CVE-2026-120730— 组织、产品及部署组 ID 强制赋值漏洞
一分钟漏洞结论
影响对象
nerves-hub nerves_hub_web
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在 nerves-hub 项目的 nerves_hub_web 模块中，存在一个“动态确定对象属性的不当修改”漏洞，影响范围包括设备 API、设备表单、签名密钥表单、产品表单以及 JITP（Just-In-Time Provisioning）设置。该漏洞允许任何拥有设备管理权限的已认证用户，通过提交伪造的 org_id、product_id 和 deployment_id 字段，将设备写入其他组织。 具体而言： 设备 API 的创建和更新操作，以及仪表板中的设备表单，会将请求参数直接传递给 函数，该函数会无条件地接
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-120730 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Mass assignment of organization, product and deployment group IDs allows users to write into other organizations and receive their firmware
来源: CVE Program / CVE List V5
Vulnerability Description
Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device forms, signing key and product forms and JITP settings in nerves-hub nerves_hub_web allows an authenticated user who manages devices in any organization to write into other organizations via submitted org_id, product_id and deployment_id fields. The device API create and update actions and the dashboard device forms pass the request parameters to NervesHub.Devices.Device.changeset/2, which casts the organization, product, deployment group and update state as given. The signing key and product forms merge the session's organization into the submitted parameters so that a submitted org_id wins, and the JITP changeset accepts any product_id. Each request requires the manage role only in the user's own organization, and any account can create one.
A device placed on another organization's deployment group, or moved into its product, is sent that organization's firmware with a download URL. The user cannot change or control devices that already belong to the other organization, and cannot upload firmware to it.
This issue affects nerves_hub: from 1.0.0 before 2.5.3.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| nerves-hub | nerves_hub_web | 1.0.0 ~ 2.5.3 |
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
|
|
| nerves-hub | nerves_hub_web | 1.0.0 ~ 2.5.3 |
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
|
|
| nerves-hub | nerves_hub_web | f58d58233dbd355c58d3a140107ece18e8863f14 ~ c367d7d17d07f843e78a70d15904665616dde964 |
cpe:2.3:a:nerves-hub:nerves_hub_web:*:*:*:*:*:*:*:*
|
|
二、漏洞 CVE-2026-120730 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-120730 的情报信息
请登录查看更多情报信息。
CVE-2026-120730 其他参考 (5)
-
https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-rpp7-x9hm-jrmr vendor-advisory related
同批安全公告 · nerves-hub · 2026-11-10 · 共 6 条
| CVE-2026-119446 | 9.4 CRITICAL | CLI 登录会话固定导致未授权获取 API 令牌漏洞 |
| CVE-2026-120999 | 7.4 HIGH | Google 身份验证不当导致账户接管漏洞 |
| CVE-2026-120295 | 7.1 HIGH | 设备批量移动功能权限绕过漏洞 |
| CVE-2026-120286 | 5.3 MEDIUM | 设备部署组事件缺失授权，允许成员修改 |
| CVE-2026-120997 | 2.3 LOW | 会话失效不当致降权成员保留旧角色权限漏洞 |