Xiaozhi-ESP32-Server Insecure Direct Object Reference in Device Address Book

Executive Summary

CVE-2026-116017 is an Insecure Direct Object Reference (IDOR) vulnerability in the xiaozhi-esp32-server's manager-api module. It allows authenticated users to access other users' device address books by exploiting a missing ownership check in the GET /device/address-book/{macAddress} endpoint. The endpoint does not verify if the requested device belongs to the user, enabling attackers to read sensitive data like contact MACs, aliases, call permissions, and owner user IDs.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor network traffic for unauthorized requests to /device/address-book/{macAddress} endpoints with MAC addresses not owned by the requesting user. Check server logs for repeated access attempts to address book endpoints with varying MAC addresses. Use tools like curl to test if the endpoint returns data for arbitrary MACs: curl -X GET http://<server>/device/address-book/<target_mac> -H 'Authorization: Bearer <token>'

Verify if version 0.9.8 or later is installed by checking the server version endpoint or release notes. If running 0.9.7 or earlier, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with a normal or self-registered account to access other users' device address books. They can obtain sensitive information such as contact MAC addresses, aliases, call permissions, and owner user IDs. Additionally, attackers can wipe another user's address book by sending a POST /device/unbind request with another user's device UUID due to lack of ownership verification.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade to version 0.9.8 or later to address the IDOR vulnerability and related issues. Ensure device ownership validation is enforced in all address book operations before and after upgrade.

Review and restrict user permissions, especially for self-registered accounts. Implement additional logging and monitoring for address book access attempts to detect exploitation attempts.

If immediate upgrade is not possible, implement network-level controls to block unauthorized access to /device/address-book endpoints until patched.

Useful 0 Not Useful 0