CVE-2025-57808
September 02, 2025
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
Affected Packages
https://github.com/esphome/esphome.git (GITHUB):
Affected version(s) =2025.8.0 <2025.8.1Fix Suggestion:
Update to version 2025.8.1esphome (PYTHON):
Affected version(s) =2025.8.0 <2025.8.1Fix Suggestion:
Update to version 2025.8.1esphome (PYTHON):
Affected version(s) >=1.10.1 <2025.8.1Fix Suggestion:
Update to version 2025.8.1Related Resources (4)
Do you need more information?
Contact UsCVSS v4
Base Score:
8.6
Attack Vector
ADJACENT
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.1
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
NONE
Weakness Type (CWE)
EPSS
Base Score:
4.05
