Xiaozhi Esp32 Server
Monthly
An insecure direct object reference in the manager-api of xiaozhi-esp32-server before 0.9.8 lets any authenticated account read other users' device address books by supplying a victim's device MAC to the /device/address-book/{macAddress} endpoint, disclosing contact MACs, aliases, call permissions and owning user IDs. The flaw requires only a normal or self-registered account plus knowledge of the target device MAC (CVSS v4.0 5.3, CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and impact is confined to confidentiality with no write or denial-of-service capability. It is not in CISA KEV and no working exploit code has been confirmed; a public technical writeup of the flaw exists, and the vendor has released a fix in v0.9.8.
An insecure direct object reference in the manager-api of xiaozhi-esp32-server before 0.9.8 lets any authenticated account read other users' device address books by supplying a victim's device MAC to the /device/address-book/{macAddress} endpoint, disclosing contact MACs, aliases, call permissions and owning user IDs. The flaw requires only a normal or self-registered account plus knowledge of the target device MAC (CVSS v4.0 5.3, CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N), and impact is confined to confidentiality with no write or denial-of-service capability. It is not in CISA KEV and no working exploit code has been confirmed; a public technical writeup of the flaw exists, and the vendor has released a fix in v0.9.8.