CVE-2025-57808
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
- CVSS 3.1
- 8.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-25)
- CWE
- CWE-303
- Published
- Modified
- Record from
- the NVD, synced
Affected
- esphome:esphome_firmware
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mxh2-ccgj-8635 | PyPI | esphome | <2025.8.1 | 2025.8.1 |
| PYSEC-2026-1330 | PyPI | esphome | <2025.8.1 | 2025.8.1 |