CVE-2025-57808
BaseFortify
Publication date: 2025-09-02
Last updated on: 2025-09-10
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| esphome | esphome_firmware | 2025.8.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-NVD-CWE-noinfo | |
| CWE-303 | The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an authentication bypass in the ESPHome web_server component on the ESP-IDF platform. The authentication check incorrectly allows access when the client-supplied base64-encoded Authorization header is empty or only a substring (prefix) of the correct value. This happens because the code compares only part of the provided credentials instead of the full string, allowing unauthorized users to bypass authentication without knowing the correct username or password. [1, 2]
How can this vulnerability impact me? :
This vulnerability allows attackers on the local network to gain unauthorized access to the ESPHome web_server functionalities, including over-the-air (OTA) updates if enabled, without any credentials. This compromises the confidentiality and integrity of the device, as attackers can control or modify the device remotely. The vulnerability has a high severity score (CVSS 8.1) and requires no privileges or user interaction to exploit. [2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by attempting to access the ESPHome web_server with an empty or truncated base64-encoded Authorization header and observing if authentication is bypassed. For example, using curl commands to send HTTP requests with incomplete or empty Authorization headers can test for the vulnerability. A sample command to test might be: curl -v -H "Authorization: Basic " http://<target-ip>/, or curl -v -H "Authorization: Basic dXNlcjpz" http://<target-ip>/ where 'dXNlcjpz' is a truncated base64 string of 'user:s'. If access is granted without valid credentials, the system is vulnerable. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include upgrading ESPHome to version 2025.8.1 or later, where the vulnerability is patched. Until the upgrade can be performed, it is recommended to disable the web_server component, especially if OTA updates are enabled, to prevent unauthorized access. [2]