esphome

6 results · Clear filters · Feed

• High 8.8
  CVE-2026-59177 Scanner template

  ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

  ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the `Home Assistant` add-on's trusted `ingress` site binds to `0.0.0.0` while intentionally skipping dashboard authentication because the supervisor is …

  esphome device-builder esphome-device-builder PyPI
  Oct 28, 2026
• High 8.6
  CVE-2026-71259

  ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution

  ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because binds tighter than , any file: URI passes validation regardless of netloc. This validator gates the field of the external_compone…

  esphome esphome
  Aug 5, 2026
• High 8.1
  CVE-2025-57808 Scanner template

  ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

  ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value i…

  esphome esphome esphome PyPI
  Sep 2, 2025
• High 8.1
  CVE-2024-29019

  ESPHome vulnerable to Authentication bypass via Cross site request forgery

  ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attacke…

  esphome esphome esphome PyPI
  Mar 21, 2024
• High 7.2
  CVE-2024-27081

  ESPHome remote code execution via arbitrary file write

  ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbit…

  esphome esphome esphome PyPI
  Feb 26, 2024
• High 7.5
  CVE-2021-41104

  web_server allows OTA update without checking user defined basic auth username & password

  ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic …

  esphome esphome esphome PyPI
  Sep 28, 2021