ESPHome CVE-2026-71260

Two configuration prerequisites must both be true: first, the ESPHome device must have the web_server: component explicitly declared in its YAML configuration (it is not enabled by default, but is commonly added for Home Assistant integration and local dashboards); second, at least one text entity in the configuration must use mode: password to store a sensitive secret. The CVSS vector confirms PR:N - no authentication is required against the web server, as ESPHome's web_server component ships with no access control by default. The primary factor limiting exploitation is the adjacent-network requirement (AV:A): the attacker must be on the same Layer-2 or directly routable network segment as the device, which rules out internet-based attackers unless port 80 is externally forwarded. Exploitation is NOT possible from the public internet under default home-router NAT configurations, but IS realistic from shared Wi-Fi, compromised IoT devices on the same network, or insider-adjacent positions.

The official CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.5) accurately characterizes the risk: high confidentiality impact with zero exploitation complexity, constrained only by the adjacent-network attack vector. The AV:A requirement is the single meaningful limiting factor - the attacker must share a network segment with the device, which is realistic in home Wi-Fi environments, shared IoT VLANs, guest networks, and scenarios involving rogue devices. No EPSS data was provided, so exploitation probability cannot be quantified statistically, but the technical difficulty is near-zero: a single unauthenticated GET request suffices, making any attacker with network adjacency a credible threat. No CISA KEV listing was identified, so active in-the-wild exploitation is not confirmed. The real-world priority is elevated relative to the moderate CVSS score because ESPHome devices are commonly configured to store sensitive secrets (Wi-Fi PSKs, Home Assistant API tokens) as password-mode text entities - the exact entities that are silently disclosed. The absence of a confirmed patched release version at time of analysis means no simple remediation path can be cited, increasing residual risk.

An attacker connected to the same Wi-Fi network or LAN segment as an ESPHome device - for example, a guest network visitor or a compromised smart device on the same VLAN - sends an unauthenticated HTTP GET to http://<device-ip>/text/<entity_id> on port 80. The device responds with a JSON object where the 'state' field shows '****' but the 'value' field contains the full plaintext credential, immediately exposing stored Wi-Fi passwords or API tokens. No exploit tooling is required; curl or a browser suffices, and the /events EventSource stream also broadcasts the plaintext value continuously.