EUVD-2026-29859Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-reachable HTTP with low complexity, but PR:L because the attacker must already hold a valid digest response for one URI; impact is unauthorized resource access, primarily confidentiality.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8.
AnalysisAI
Digest authentication bypass in Espressif's arduino-esp32 WebServer (all versions prior to 3.3.8) lets an attacker who holds any single valid digest response replay it to reach a different protected endpoint, defeating per-resource access control. The flaw is CWE-287 (improper authentication) because the server trusts the URI value inside the client's Authorization header instead of binding the hash to the actually-requested resource. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 13th percentile), and CISA SSVC marks exploitation as none but automatable.
Technical ContextAI
The affected component is the WebServer library shipped in the arduino-esp32 core, which targets ESP32, ESP32-S2/S3, ESP32-C3/C6 and ESP32-H2 microcontrollers (CPE cpe:2.3:a:espressif:arduino-esp32). HTTP Digest Access Authentication (RFC 2617/7616) requires the client to fold several fields - including the request URI - into an MD5/SHA response hash so that a captured response cannot be replayed against a different resource. Here the server recomputes and validates the hash using the URI string supplied in the client's Authorization header rather than the URI on the actual request line, so the cryptographic binding between the credential and the specific resource is broken. This is a classic CWE-287 improper-authentication defect where a security-relevant input is taken from an attacker-controlled field without cross-checking it against the trusted request context.
RemediationAI
Vendor-released patch: upgrade the arduino-esp32 core to 3.3.8 or later and rebuild/reflash affected firmware, per advisory GHSA-28hv-fwm3-rpcq (https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq). Where immediate reflashing of fielded devices is impractical, compensating controls include: restricting network reachability of the device's WebServer to a trusted management VLAN or via firewall/ACL so digest responses cannot be captured or replayed by outside parties (trade-off: breaks any legitimate remote access); avoiding reliance on per-URI digest authorization for privilege separation and instead requiring the same credential for all protected endpoints so cross-URI replay grants nothing extra (trade-off: coarser access model); and placing a reverse proxy in front of the device that re-validates the request URI against the Authorization header URI before forwarding (trade-off: added component and latency on constrained deployments). If Digest auth is not required, disabling it or switching the endpoint to a properly URI-bound auth scheme also removes the exposure.
More in Arduino Esp32
View allThe EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes
Stack-based buffer overflow in the arduino-esp32 WebServer multipart form parser (all releases prior to 3.3.8) lets a re
Memory corruption in arduino-esp32's NBNS packet handler allows adjacent network attackers to achieve remote code execut
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today