ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.
References
| Link | Resource |
|---|---|
| https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1e | Patch Third Party Advisory |
| https://github.com/esphome/esphome/releases/tag/2021.9.2 | Release Notes Third Party Advisory |
| https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm | Patch Third Party Advisory |
Configurations
Configuration 1 (hide)
| AND |
|
History
07 Oct 2021, 14:13
| Type | Values Removed | Values Added |
|---|---|---|
| References | (CONFIRM) https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1e - Patch, Third Party Advisory | |
| References | (MISC) https://github.com/esphome/esphome/releases/tag/2021.9.2 - Release Notes, Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 7.5 |
| CPE | cpe:2.3:h:espressif:esp8266:-:*:*:*:*:*:*:* cpe:2.3:o:esphome:esphome_firmware:*:*:*:*:*:*:*:* cpe:2.3:h:espressif:esp32:-:*:*:*:*:*:*:* |
28 Sep 2021, 16:30
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-09-28 16:15
Updated : 2023-12-10 14:09
NVD link : CVE-2021-41104
Mitre link : CVE-2021-41104
CVE.ORG link : CVE-2021-41104
JSON object : View
Products Affected
esphome
- esphome_firmware
espressif
- esp32
- esp8266
CWE
CWE-306
Missing Authentication for Critical Function