CVE-2024-27081CWE-22

ESPHome remote code execution via arbitrary file write

High · published February 26, 2024

CVSS v3.1
7.2
EPSS
2%
Percentile
74.6
In the wild
Unconfirmed
What it is

ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. This vulnerability is patched in 2024.2.1.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01535 · 74.6th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-02-26T16:29Z
EPSS history
Timeline
  • 26 FEB 16:29Z
    ESPHome remote code execution via arbitrary file write
    cvelistv5