CVE-2025-57808
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
Vendor
Product
CWE
Yayın Tarihi
2025-09-02 01:15:29
Güncelleme
2025-09-10 19:03:00
Source Identifier
security-advisories@github.com
KEV Date Added
-