CVE-2025-57808CWE-303

CVE-2025-57808

High · published September 2, 2025

CVSS v3.1
8.1
EPSS
2%
Percentile
76.0
In the wild
Unconfirmed
What it is

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01627 · 76.0th percentile
Weakness
CWE-303 · Incorrect Implementation of Authentication Algorithm
Published
2025-09-02T05:15Z
Affected products (1)
ProductVersionsFixed in
esphome/esphome_firmwareall versions—
References (3)
https://github.com/esphome/esphome/commit/2aceb56606ec8afec5f49c92e140c8050a6ccbe5 · [email protected]https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635 · [email protected]https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 02 SEP 00:26Z
    ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
    cvelistv5