PT-2023-28153 · Unknown · Home Assistant

Frenck · Published 2023-10-19 · Updated 2025-10-14 · CVE-2023-41897

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Home Assistant versions prior to 2023.9.0

Description The issue concerns the omission of HTTP security headers, including the X-Frame-Options header, in Home Assistant server. This omission facilitates covert clickjacking attacks and other exploit opportunities, allowing attackers to trick users into installing malicious add-ons with minimal interaction. This could enable Remote Code Execution (RCE) within the Home Assistant application.

Recommendations For versions prior to 2023.9.0, upgrade to version 2023.9.0 to address the issue. As a temporary workaround, consider restricting access to the Home Assistant web interface to minimize the risk of exploitation. Avoid using the web interface until the issue is resolved.

Exploit

Fix

Clickjacking

Weakness Enumeration

CWE-1021

Related Identifiers

CVE-2023-41897

GHSA-935V-RMG9-44MW

GHSA-CR83-Q7R2-7F5Q

Affected Products

Home Assistant

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41897.json · Exploit
• https://github.com/home-assistant/core/security/advisories/GHSA-935v-rmg9-44mw · Vendor Advisory
• https://home-assistant.io/blog/2023/10/19/security-audits-of-home-assistant · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41897 · Security Note
• https://osv.dev/vulnerability/CVE-2023-41897 · Vendor Advisory
• https://github.com/home-assistant/core/security/advisories/GHSA-cr83-q7r2-7f5q · Note
• https://twitter.com/dailycve/status/1978187755545886734 · Twitter Post
• https://twitter.com/CVEnew/status/1715133134579126345 · Twitter Post
• https://t.me/cvenotify/59771 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1715163959030915547 · Twitter Post