EUVD-2026-39989
GHSA-2vm4-w283-mr2p
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N for WebSocket access; AC:H for concurrent-client requirement; PR:L for initial connection; C:L added because broadcast inherently discloses cross-client MCP responses.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A weakness has been identified in 78 xiaozhi-esp32 up to 2.2.6. Affected by this issue is the function ParseMessage of the file main/mcp_server.cc of the component MCP Response Handler. This manipulation causes improper synchronization. Remote exploitation of the attack is possible. The attack's complexity is rated as high. The exploitation is known to be difficult. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
AnalysisAI
Improper response routing in xiaozhi-esp32 firmware up to version 2.2.6 allows any authenticated WebSocket client to receive MCP (Model Context Protocol) responses intended for other connected clients, enabling cross-client information disclosure and low-integrity interference. The flaw resides in the ParseMessage function within main/mcp_server.cc, where the MCP Response Handler broadcasts responses globally to all connected WebSocket clients on port 8080 rather than routing replies back to the originating client. A public proof-of-concept is available via GitHub issue #2020; no active exploitation has been confirmed in CISA KEV, and the CVSS 4.0 score of 2.3 reflects high attack complexity and limited overall impact in this niche IoT context.
Technical ContextAI
xiaozhi-esp32 (CPE: cpe:2.3:a:78:xiaozhi-esp32:*:*:*:*:*:*:*:*) is an open-source AI companion firmware for Espressif ESP32 microcontrollers that implements an MCP server accessible over WebSocket on port 8080. The root cause, classified as CWE-662 (Improper Synchronization), is the absence of a client-session binding between incoming MCP requests and outgoing responses: the pre-patch code registered a global broadcast callback via RegisterMcpBroadcastCallback that invoked BroadcastMessage to every connected WebSocket client indiscriminately. The PR #2021 fix introduces a ClientInfo struct tracking a per-connection uint64_t client_id, a GetClientId() lookup, and a per-client response_sender callback injected into ParseMessage, replacing broadcast with targeted delivery and adding stale-client detection in SendMessage via client_id comparison. The vulnerability manifests specifically in the otto-robot board configuration that instantiates WebSocketControlServer.
RemediationAI
An upstream fix is available as GitHub pull request #2021 (https://github.com/78/xiaozhi-esp32/pull/2021), which replaces the global broadcast mechanism with targeted per-client response delivery; however, this PR was pending acceptance at time of analysis, and no released patched version number has been independently confirmed. Users should monitor the repository for a tagged release incorporating this PR and upgrade firmware immediately upon availability. As a compensating control, restrict network access to port 8080 via host-based firewall rules or VLAN segmentation so only explicitly trusted clients can reach the WebSocket control server - this limits the attacker pool at the cost of reducing remote accessibility. If the WebSocket control server feature is not operationally required for a given deployment, disabling it in the board configuration eliminates the attack surface entirely. Until patched, avoid deploying the device in environments where multiple untrusted clients share network access to port 8080.
More in Xiaozhi Esp32
View allSame weakness CWE-662 – Improper Synchronization
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today