Skip to content
OpenAdvisories

Package · PyPI

esphome

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • Low 1.7
    CVE-2026-23833

    ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The…

    esphome esphome esphome PyPI
  • High 8.1
    CVE-2025-57808 Scanner template

    ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value i…

    esphome esphome esphome PyPI
  • High 8.1
    CVE-2024-29019

    ESPHome vulnerable to Authentication bypass via Cross site request forgery

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attacke…

    esphome esphome esphome PyPI
  • Medium 6.5
    CVE-2024-27287

    ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API

    ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and H…

    esphome esphome esphome PyPI
  • High 7.2
    CVE-2024-27081

    ESPHome remote code execution via arbitrary file write

    ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbit…

    esphome esphome esphome PyPI
  • High 7.5
    CVE-2021-41104

    web_server allows OTA update without checking user defined basic auth username & password

    ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic …

    esphome esphome esphome PyPI