Arduino Esp32
Monthly
Stack-based buffer overflow in the arduino-esp32 WebServer multipart form parser (all releases prior to 3.3.8) lets a remote attacker crash the device and potentially achieve code execution by sending an oversized multipart/form-data boundary value. The parser sizes a stack Variable Length Array from the attacker-controlled Content-Type boundary field with no length cap, so a boundary longer than ~8000 characters overruns the 8192-byte loopTask stack. Publicly available proof-of-concept exploit code exists (SSVC: poc); it is not listed in CISA KEV and EPSS remains low at 0.20%.
Digest authentication bypass in Espressif's arduino-esp32 WebServer (all versions prior to 3.3.8) lets an attacker who holds any single valid digest response replay it to reach a different protected endpoint, defeating per-resource access control. The flaw is CWE-287 (improper authentication) because the server trusts the URI value inside the client's Authorization header instead of binding the hash to the actually-requested resource. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 13th percentile), and CISA SSVC marks exploitation as none but automatable.
Memory corruption in arduino-esp32's NBNS packet handler allows adjacent network attackers to achieve remote code execution on ESP32-family microcontrollers without authentication. Affects all versions prior to 3.3.8 when NetBIOS is explicitly enabled via NBNS.begin(). The parser trusts attacker-controlled name_len field from UDP port 137 traffic, writing unbounded data to fixed-size buffers. EPSS data not available, no CISA KEV listing, but GitHub security advisory confirms the vulnerability with patch released in version 3.3.8.
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Stack-based buffer overflow in the arduino-esp32 WebServer multipart form parser (all releases prior to 3.3.8) lets a remote attacker crash the device and potentially achieve code execution by sending an oversized multipart/form-data boundary value. The parser sizes a stack Variable Length Array from the attacker-controlled Content-Type boundary field with no length cap, so a boundary longer than ~8000 characters overruns the 8192-byte loopTask stack. Publicly available proof-of-concept exploit code exists (SSVC: poc); it is not listed in CISA KEV and EPSS remains low at 0.20%.
Digest authentication bypass in Espressif's arduino-esp32 WebServer (all versions prior to 3.3.8) lets an attacker who holds any single valid digest response replay it to reach a different protected endpoint, defeating per-resource access control. The flaw is CWE-287 (improper authentication) because the server trusts the URI value inside the client's Authorization header instead of binding the hash to the actually-requested resource. There is no public exploit identified at time of analysis, EPSS is very low (0.04%, 13th percentile), and CISA SSVC marks exploitation as none but automatable.
Memory corruption in arduino-esp32's NBNS packet handler allows adjacent network attackers to achieve remote code execution on ESP32-family microcontrollers without authentication. Affects all versions prior to 3.3.8 when NetBIOS is explicitly enabled via NBNS.begin(). The parser trusts attacker-controlled name_len field from UDP port 137 traffic, writing unbounded data to fixed-size buffers. EPSS data not available, no CISA KEV listing, but GitHub security advisory confirms the vulnerability with patch released in version 3.3.8.
The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.