CVE-2024-27081

2024-02-2617:15:10

CWE-22

[email protected]

web.nvd.nist.gov

esphome

cve-2024-27081

security misconfiguration

remote code execution

nvd

esp8266

esp32

api

dashboard

7.2 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

7.3 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

JSON

ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. This vulnerability is patched in 2024.2.1.

Affected configurations

Vulners

Node

esphomeesphome_firmwareMatch2023.12.9

VendorProductVersionCPE
esphomeesphome_firmware2023.12.9cpe:2.3:o:esphome:esphome_firmware:2023.12.9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
esphome	esphome_firmware	2023.12.9	cpe:2.3:o:esphome:esphome_firmware:2023.12.9:::::::*

CNA Affected

[
  {
    "vendor": "esphome",
    "product": "esphome",
    "versions": [
      {
        "version": "= 2023.12.9",
        "status": "affected"
      }
    ]
  }
]