What is the CVSS score of CVE-2026-71260?

CVE-2026-71260 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

ESPHome CVE-2026-71260

EUVD-2026-53345 MEDIUM

Insufficiently Protected Credentials (CWE-522)

2026-08-05 TuranSec

GHSA-qmjj-2rwx-5ffc

Information Disclosure Esphome

6.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

6.5 MEDIUM

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Adjacent-network (AV:A) because device is LAN-bound; PR:N confirmed by default no-auth web_server; C:H for full plaintext credential exposure; no integrity or availability impact applies.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 05, 2026 - 13:31 vuln.today

DescriptionCVE.org

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_() (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "****", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value()/set_json_value(). Because web_server listens on port 80 with no authentication by default, any attacker on the local network can retrieve the plaintext password (e.g. WiFi credentials, API tokens) via GET /text/<entity_id> or the /events EventSource stream.

AnalysisAI

ESPHome's built-in web server unconditionally leaks plaintext passwords stored in password-mode text entities to any unauthenticated attacker on the local network. The web_server component on port 80 - which carries no authentication by default - serializes text entities with a dual-field JSON structure where the 'state' field is correctly redacted to '****' but the 'value' field is always populated with the raw secret via set_json_icon_state_value()/set_json_value(), exposing WiFi credentials, API tokens, and similar secrets through a trivial GET request or the /events EventSource stream. No public exploit code or CISA KEV listing has been identified at time of analysis, but exploitation requires only standard HTTP tooling against any reachable device with the web_server component enabled.

Technical ContextAI

ESPHome is an open-source firmware framework targeting ESP8266/ESP32 microcontrollers, widely used in the Home Assistant ecosystem for custom IoT sensors and devices. Its web_server component exposes a REST API and an EventSource stream reflecting device entity state on port 80. The defect is in WebServer::text_json_() within esphome/components/web_server/web_server.cpp: when serializing a text entity marked TEXT_MODE_PASSWORD, the code produces two separate fields - 'state' is set to the redacted placeholder, but the unconditional call to set_json_icon_state_value()/set_json_value() writes the raw cleartext value into the 'value' field regardless of the mode flag. This is a textbook CWE-522 (Insufficiently Protected Credentials) instance: the developer added masking logic to one output path but failed to guard the parallel value-serialization path. The CPE cpe:2.3:a:esphome:esphome:*:*:*:*:*:*:*:* covers the full version range through the reported 2026.7.0-dev ceiling. The web server's default no-authentication posture means no additional bypass is required once network adjacency is achieved.

RemediationAI

No vendor-released patched version has been confirmed at time of analysis; monitor the ESPHome GitHub repository (https://github.com/esphome/esphome) for a fix to WebServer::text_json_() in web_server.cpp that redacts the 'value' field for TEXT_MODE_PASSWORD entities. The most effective immediate compensating control is to remove the web_server: block from the ESPHome YAML configuration and reflash the device - this eliminates the attack surface entirely at the cost of losing the built-in web dashboard and REST/EventSource API. If the web server must remain active, apply a network-level firewall rule or VLAN policy blocking port 80 on ESPHome devices to all hosts except a trusted management workstation; note this does not protect against other devices already on the same subnet. As an additional precaution, avoid storing high-value credentials such as Wi-Fi PSKs or external API tokens as text entities with mode: password in ESPHome until a confirmed fix is available, and consider rotating any credentials already stored in this manner.