Xiaozhi-esp32-server-java CVE-2026-111623

Exploitation requires the target to be running xiaozhi-esp32-server-java (through 6.1.0) with the /api/device/ota OTA endpoint network-reachable, and the attacker must supply a MAC address corresponding to an existing provisioned victim device to obtain a usable WebSocket token and reach that device's data (role prompts, conversation history, metadata, and backend LLM/STT/TTS credentials). No authentication or user interaction is needed (PR:N/UI:N), but exploitation is limited by the need to know or enumerate a valid device MAC and by the server actually exposing the OTA endpoint - reflected in the CVSS AC:H/AT:P attack requirement; impact is bounded to data accessible over a single device's WebSocket channel rather than full server compromise.

Multiple signals converge on a MEDIUM, not a top-tier, priority. The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L) scores 6.3: the flaw is network-reachable and unauthenticated (PR:N), but carries both high attack complexity (AC:H) and a present attack requirement (AT:P), and all three impacts are only Low with no scope change (SC/SI/SA:N). No EPSS score, KEV listing, or explicit POC flag was supplied in the input, so there is no evidence of active exploitation - exploitation status is 'no public exploit identified at time of analysis,' though VulnCheck and a detailed hackmd write-up document the token-issuance mechanics, lowering the practical barrier to reproduction. The PR:N/UI:N combination makes this attractive for opportunistic abuse, but AC:H/AT:P plus the need to target an existing provisioned device (a specific MAC) means this is realistically targeted rather than internet-wide mass exploitation. Net: a genuine authentication-bypass concern for anyone running this specific server, but the Low technical impacts and niche deployment footprint keep it well below critical-patch-now urgency. No key signals conflict; the main gap is the absence of EPSS/KEV/patch data, so risk is inferred from the CVSS vector and description only.

An unauthenticated attacker on the network sends a request to /api/device/ota supplying a victim device's MAC address and receives a valid WebSocket token in response. Using that token, the attacker opens the victim's WebSocket channel to read the private role system prompt, write or poison conversation history, and burn the operator's paid LLM/STT/TTS credentials. A public technical write-up (hackmd) describes the token-issuance flaw, but no packaged exploit code was indicated in the input.