The critical vulnerability here isn't the missing authentication — it's that authentication was available and simply not applied. The AuthToken guard exists elsewhere in this codebase, which means every developer working on rust-iot-platform had access to the correct security primitive. They just didn't use it on this route. This is a textbook pattern drift failure: security controls that exist as convention rather than constraint, leaving gaps that depend entirely on individual developer attention.

Worse, this route feeds into unsandboxed JavaScript execution via quick_js. Even if you add the AuthToken guard tomorrow, you still have an authenticated user who can run arbitrary code on your IoT platform server. The eval() call in the execution path is the deeper architectural problem — this route just provided the first unauthenticated entry point to reach it. Check every other route that can trigger the same calc_run_biz.rs execution path. If those are also auth-protected, you have a harder problem: an authenticated code injection surface that no route should need.

For immediate remediation: add AuthToken to calc_rule_router.rs. For structural improvement: make AuthToken mandatory at the routing layer so a missing guard produces a visible error rather than a runtime gap. In Rust, the borrow checker enforces memory safety but says nothing about authentication — that enforcement gap is exactly what caught this team. The language gives confidence without providing security. Your architecture must do what the compiler cannot.

In IoT contexts, RCE isn't just data compromise — it's potential control of physical devices. That amplification is why this warrants urgent priority despite the CVSS score.