ESPHome Device Builder <1.0.10 - Unauthenticated Dashboard Access
ESPHome Device Builder versions before 1.0.10 bind the trusted Home Assistant ingress site to all interfaces. A client that can reach the ingress port can therefore access the dashboard without the Supervisor's authentication proxy.
PoC 已收录ESPHome Device Builder
CVSS—