CVE-2025-57808
HighCVSS 8.1Exploitation Probability (EPSS)
High risk76th percentile - higher than 76% of all known CVEs
Summary
In ESPHome version 2025.8.0 on the ESP-IDF platform, the web_server authentication check can incorrectly pass when the client-supplied base64-encoded Authorization value is empty or a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing the correct username or password. The issue is patched in version 2025.8.1.
Risk Assessment
An unauthenticated attacker could gain access to the web interface and potentially perform OTA updates, leading to device compromise.
Recommendation
Update ESPHome to version 2025.8.1 or later. If possible, disable the web_server or restrict network access to it.
Other vulnerabilities in ESPHome
See all- CVE-2026-71260Medium
ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.
- CVE-2026-71259High
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py. Because [operator] binds tighter than [operator], any file: URI passes validation regardless of netloc. This validator gates the field of the external_components YAML directive's git source schema, which is passed to [function] (git supports file:// natively).
Original NVD description (English source)
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS