What is the CVSS score of CVE-2025-53540?

CVE-2025-53540 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

How to fix or mitigate CVE-2025-53540?

Within 24 hours: Identify all ESP32 deployments using HTTPUpdateServer or OTA examples in your inventory and document current arduino-esp32 versions. Within 7 days: Upgrade arduino-esp32 to version 3.2.1 or later across all development environments and device firmware builds; conduct internal code review of custom OTA implementations for similar CSRF vulnerabilities. Within 30 days: Deploy updated firmware to all production ESP32 devices, test OTA update functionality in staging environment first, and implement network segmentation to restrict firmware update endpoints to trusted internal networks only.

CVE-2025-53540

EUVD-2025-20306 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2025-07-07 security-advisories@github.com

RCE CSRF

8.7

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:34 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

3.2.1

EUVD ID Assigned

Mar 16, 2026 - 03:37 euvd

EUVD-2025-20306

Analysis Generated

Mar 16, 2026 - 03:37 vuln.today

CVE Published

Jul 07, 2025 - 20:15 nvd

HIGH 8.7

DescriptionGitHub Advisory

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPUpdateServer implementation are vulnerable to Cross-Site Request Forgery (CSRF). The update endpoints accept POST requests for firmware uploads without CSRF protection. This allows an attacker to upload and execute arbitrary firmware, resulting in remote code execution (RCE). This vulnerability is fixed in 3.2.1.

Analysis

Technical ContextAI

Cross-Site Request Forgery forces authenticated users to perform unintended actions by tricking their browser into sending forged requests. This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352).