Executive Summary

This vulnerability is an authentication bypass in the ESPHome web_server component on the ESP-IDF platform. The authentication check incorrectly allows access when the client-supplied base64-encoded Authorization header is empty or only a substring (prefix) of the correct value. This happens because the code compares only part of the provided credentials instead of the full string, allowing unauthorized users to bypass authentication without knowing the correct username or password. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers on the local network to gain unauthorized access to the ESPHome web_server functionalities, including over-the-air (OTA) updates if enabled, without any credentials. This compromises the confidentiality and integrity of the device, as attackers can control or modify the device remotely. The vulnerability has a high severity score (CVSS 8.1) and requires no privileges or user interaction to exploit. [2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting to access the ESPHome web_server with an empty or truncated base64-encoded Authorization header and observing if authentication is bypassed. For example, using curl commands to send HTTP requests with incomplete or empty Authorization headers can test for the vulnerability. A sample command to test might be: curl -v -H "Authorization: Basic " http://<target-ip>/, or curl -v -H "Authorization: Basic dXNlcjpz" http://<target-ip>/ where 'dXNlcjpz' is a truncated base64 string of 'user:s'. If access is granted without valid credentials, the system is vulnerable. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading ESPHome to version 2025.8.1 or later, where the vulnerability is patched. Until the upgrade can be performed, it is recommended to disable the web_server component, especially if OTA updates are enabled, to prevent unauthorized access. [2]

Useful 0 Not Useful 0