Skip to content
OpenAdvisories

Vendor

xinnan-tech

2 known vulnerabilities.

Products

xiaozhi-esp32-server 2
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.8
    CVE-2026-119703

    xiaozhi-esp32-server through 0.9.8 Authentication Bypass via Spoofed Device-ID Header

    xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that allows remote unauthenticated attackers to skip Bearer HMAC token verification by spoofing the Device-ID header. Attackers supplying an all…

    xinnan-tech xiaozhi-esp32-server
  • Medium 4.3
    CVE-2026-116017

    Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint

    Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-…

    xinnan-tech xiaozhi-esp32-server