PT-2026-3475 · Espressif Systems+3 · Esp32+4

Mat931 · Publicado 2026-01-19 · Atualizado 2026-04-17 · CVE-2026-23833

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions ESPHome versions 2025.9.0 through 2025.12.6

Description ESPHome is a system for remote microcontroller control via Home Automation systems. An integer overflow in the API component’s protobuf decoder can lead to denial-of-service attacks when API encryption is not used. The check ptr + field length > end within components/api/proto.cpp is susceptible to overflow if a malicious client transmits a large field length value. This impacts all ESPHome device platforms, including ESP32, ESP8266, RP2040, and LibreTiny. The overflow circumvents the bounds check, resulting in the device reading invalid memory and crashing. Exploitation via the plaintext API protocol does not require authentication, while noise encryption requires knowledge of the encryption key.

Recommendations Upgrade to ESPHome version 2025.12.7 or later. Enable API encryption with a unique key per device. Follow ESPHome Security Best Practices.

Exploit

Correção

DoS

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

CVE-2026-23833

GHSA-4H3H-63V6-88QX

Produtos afetados

Esp32

Esp8266

Esphome

Libretiny

Rp2040

Referências · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23833.json · Exploit
• https://github.com/esphome/esphome/commit/69d7b6e9210390051318bd8e6410727689de08d6 · Correção
• https://github.com/esphome/esphome/pull/13306 · Correção
• https://github.com/esphome/esphome/security/advisories/GHSA-4h3h-63v6-88qx · Aviso do Fabricante
• https://github.com/esphome/esphome · Nota
• https://reddit.com/r/IOT/comments/1snoiwx/my_thoughts_on_cyber_warfare_using_iot_devices · Publicação no Reddit
• https://osv.dev/vulnerability/CVE-2026-23833 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2013316909173809553 · Publicação no Twitter
• https://t.me/cveNotify/154111 · Publicação no Telegram
• https://esphome.io/guides/security_best_practices · Nota
• https://twitter.com/VulmonFeeds/status/2013339669019132340 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23833 · Nota de Segurança
• https://twitter.com/_cvereports/status/2013916583471575463 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-4h3h-63v6-88qx · Aviso do Fabricante
• https://reddit.com/r/IOT/comments/1slty6n/bluetooth_on_iot_devices · Publicação no Reddit