ESPHome Web Server access - Unauthenticated Access
ESPHome is a powerful smart home devices with simple YAML configuration.
esphomePoC 已收录
CVSS—
共找到 3 条公开漏洞记录
ESPHome is a powerful smart home devices with simple YAML configuration.
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
ESPHome Dashboard exposes the secrets like wifi password,api keys and internal logs, it also allows users to make changes through the dashboard.