Xiaozhi Esp32 Server Java
Monthly
Authentication bypass in Xiaozhi-esp32-server-java through 6.1.0 lets unauthenticated remote attackers request /api/device/ota with a valid MAC address and receive a device WebSocket token, enabling access to that device's channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata. No public exploit was identified at time of analysis, and the assessed risk is MEDIUM rather than top-tier because the attacker must know or enumerate a provisioned device MAC and the OTA endpoint must be network-reachable; impact is bounded to a single device's WebSocket channel rather than full server compromise.
Authentication bypass in Xiaozhi-esp32-server-java through 6.1.0 lets unauthenticated remote attackers request /api/device/ota with a valid MAC address and receive a device WebSocket token, enabling access to that device's channel to read private role system prompts, write conversation history, consume LLM/STT/TTS credentials, and overwrite device metadata. No public exploit was identified at time of analysis, and the assessed risk is MEDIUM rather than top-tier because the attacker must know or enumerate a provisioned device MAC and the OTA endpoint must be network-reachable; impact is bounded to a single device's WebSocket channel rather than full server compromise.