CVE-2025-53540CWE-352

CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Execution

High · published July 7, 2025

CVSS v4.0
8.7
EPSS
0%
Percentile
25.6
In the wild
Unconfirmed
What it is

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPUpdateServer implementation are vulnerable to Cross-Site Request Forgery (CSRF). The update endpoints accept POST requests for firmware uploads without CSRF protection. This allows an attacker to upload and execute arbitrary firmware, resulting in remote code execution (RCE). This vulnerability is fixed in 3.2.1.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00334 · 25.6th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2025-07-07T19:26Z
EPSS history
Timeline
  • 07 JUL 19:26Z
    CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Execution
    cvelistv5