PYSEC-2021-351

2021-09-2816:15:00

Google

osv.dev

0.001 Low

EPSS

Percentile

36.9%

JSON

ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which web_server allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove web_server.

CPENameOperatorVersion
esphomeeq1.16.0b4
esphomeeq1.13.0b5
esphomeeq1.12.0b3
esphomeeq2021.9.0b1
esphomeeq1.11.2
esphomeeq1.13.0b2
esphomeeq1.14.3
esphomeeq1.16.0b8
esphomeeq1.18.0b4
esphomeeq1.13.0

Name	Operator	Version
esphome	eq	1.16.0b4
esphome	eq	1.13.0b5
esphome	eq	1.12.0b3
esphome	eq	2021.9.0b1
esphome	eq	1.11.2
esphome	eq	1.13.0b2
esphome	eq	1.14.3
esphome	eq	1.16.0b8
esphome	eq	1.18.0b4
esphome	eq	1.13.0