Description
Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| arendst | Tasmota | ≤ 16.0.0 | — |
References
- Patch Commit patch issue-tracking
- VulnCheck Advisory: Tasmota 16.0.0 CSRF via Referer Header Validation Bypass third-party-advisory