PT-2021-23091 · Esphome · Esphome

Published 2021-09-28 · Updated 2021-10-07 · CVE-2021-41104

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ESPHome versions 2021.9.1 and earlier

Description The issue affects ESPHome, a system to control the ESP8266/ESP32, where the web server allows over-the-air (OTA) updates without checking user-defined basic auth username and password when HTTP basic auth is configured. This issue is patched in version 2021.9.2.

Recommendations For ESPHome versions 2021.9.1 and earlier, update to version 2021.9.2 to resolve the issue. As a temporary workaround, consider disabling or removing the web server to minimize the risk of exploitation.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2021-41104

GHSA-48MJ-P7X2-5JFM

PYSEC-2021-351

Affected Products

Esphome

References · 13

• https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1e · Patch
• https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41104 · Security Note
• https://osv.dev/vulnerability/GHSA-48mj-p7x2-5jfm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-41104 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-351 · Vendor Advisory
• https://github.com/esphome/esphome/releases/tag/2021.9.2 · Note
• https://github.com/esphome/esphome · Note
• https://github.com/esphome/esphome/commit/2234f6aacf8cc653307fed80f3750317a82c4f83 · Note
• https://github.com/esphome/esphome/commit/be965a60eba6bb769e2a5afdbc8eed132f077a59 · Note
• https://github.com/esphome/esphome/pull/2409 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/esphome/PYSEC-2021-351.yaml · Note
• https://t.me/cibsecurity/29588 · Telegram Post