Skip to content
OpenAdvisories

Package · PyPI

esphome

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 8.1
    CVE-2025-57808 Scanner template

    ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value i…

    esphome esphome esphome PyPI
  • High 8.1
    CVE-2024-29019

    ESPHome vulnerable to Authentication bypass via Cross site request forgery

    ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attacke…

    esphome esphome esphome PyPI
  • High 7.2
    CVE-2024-27081

    ESPHome remote code execution via arbitrary file write

    ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbit…

    esphome esphome esphome PyPI
  • High 7.5
    CVE-2021-41104

    web_server allows OTA update without checking user defined basic auth username & password

    ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic …

    esphome esphome esphome PyPI