GitHub Advisory DatabaseGHSA-48MJ-P7X2-5JFMBasic auth bypass in esphome
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
36.9%
Impact
Anyone with web_server enabled and HTTP basic auth configured on 2021.9.1 or older
web_server allows OTA update without checking user defined basic auth username & password
Patches
Patch released in 2021.9.2
Workarounds
Disable/remove web_server
Affected configurations
References
github.com/advisories/GHSA-48mj-p7x2-5jfm
github.com/esphome/esphome/commit/be965a60eba6bb769e2a5afdbc8eed132f077a59
github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1e
github.com/esphome/esphome/releases/tag/2021.9.2
github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm
nvd.nist.gov/vuln/detail/CVE-2021-41104
Related
4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
0.001 Low
EPSS
Percentile
36.9%