Esphome
Monthly
Remote code execution in ESPHome through 2026.7.0-dev allows any attacker who can supply a crafted YAML configuration to execute arbitrary Python code on the machine that processes it. The vulnerability is an operator-precedence bug in the cv.url() validator: Python's 'and' binding tighter than 'or' causes any file:// URI to unconditionally pass validation, bypassing the intended network-URI-only restriction on the external_components git source URL field. ESPHome then invokes git clone against the attacker-supplied local path and loads the resulting repository into Python's import machinery, yielding full code execution with the privileges of the esphome process; no public exploit has been identified at time of analysis.
ESPHome versions 2025.9.0 through 2025.12.6 are vulnerable to a denial-of-service attack via integer overflow in the API protobuf decoder, affecting all supported microcontroller platforms (ESP32, ESP8266, RP2040, LibreTiny). Unauthenticated attackers can crash ESPHome devices by sending specially crafted packets with large field length values to bypass bounds checking when API encryption is disabled. Upgrade to version 2025.12.7 or later to remediate.
ESPHome's built-in web server unconditionally leaks plaintext passwords stored in password-mode text entities to any unauthenticated attacker on the local network. The web_server component on port 80 - which carries no authentication by default - serializes text entities with a dual-field JSON structure where the 'state' field is correctly redacted to '********' but the 'value' field is always populated with the raw secret via set_json_icon_state_value()/set_json_value(), exposing WiFi credentials, API tokens, and similar secrets through a trivial GET request or the /events EventSource stream. No public exploit code or CISA KEV listing has been identified at time of analysis, but exploitation requires only standard HTTP tooling against any reachable device with the web_server component enabled.
ESPHome is a system to control microcontrollers remotely through Home Automation systems. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
ESPHome is a system to control your ESP8266/ESP32. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
ESPHome is a system to control the ESP8266/ESP32. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Remote code execution in ESPHome through 2026.7.0-dev allows any attacker who can supply a crafted YAML configuration to execute arbitrary Python code on the machine that processes it. The vulnerability is an operator-precedence bug in the cv.url() validator: Python's 'and' binding tighter than 'or' causes any file:// URI to unconditionally pass validation, bypassing the intended network-URI-only restriction on the external_components git source URL field. ESPHome then invokes git clone against the attacker-supplied local path and loads the resulting repository into Python's import machinery, yielding full code execution with the privileges of the esphome process; no public exploit has been identified at time of analysis.
ESPHome versions 2025.9.0 through 2025.12.6 are vulnerable to a denial-of-service attack via integer overflow in the API protobuf decoder, affecting all supported microcontroller platforms (ESP32, ESP8266, RP2040, LibreTiny). Unauthenticated attackers can crash ESPHome devices by sending specially crafted packets with large field length values to bypass bounds checking when API encryption is disabled. Upgrade to version 2025.12.7 or later to remediate.
ESPHome's built-in web server unconditionally leaks plaintext passwords stored in password-mode text entities to any unauthenticated attacker on the local network. The web_server component on port 80 - which carries no authentication by default - serializes text entities with a dual-field JSON structure where the 'state' field is correctly redacted to '********' but the 'value' field is always populated with the raw secret via set_json_icon_state_value()/set_json_value(), exposing WiFi credentials, API tokens, and similar secrets through a trivial GET request or the /events EventSource stream. No public exploit code or CISA KEV listing has been identified at time of analysis, but exploitation requires only standard HTTP tooling against any reachable device with the web_server component enabled.
ESPHome is a system to control microcontrollers remotely through Home Automation systems. Rated high severity (CVSS 8.1), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
ESPHome is a system to control your ESP8266/ESP32. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
ESPHome is a system to control the ESP8266/ESP32. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.