PT-2025-26778 · Espressif · Esp-Idf

Xiaobye-Ctf · Published 2025-06-24 · Updated 2026-01-22 · CVE-2025-52471

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ESF-IDF versions 5.1.6, 5.2.5, 5.3.3, and 5.4.1

Description: An integer underflow vulnerability has been identified in the ESP-NOW protocol implementation within the ESP Wi-Fi component of the ESP-IDF framework. This issue stems from insufficient validation of user-supplied data length in the packet receive function. Under certain conditions, this may lead to out-of-bounds memory access and may allow arbitrary memory write operations. On systems without a memory protection scheme, this behavior could potentially be used to achieve remote code execution (RCE) on the target device.

Recommendations: For ESP-IDF v5.3 and earlier, a workaround can be applied by validating that the data len parameter received in the RX callback (registered via esp now register recv cb()) is a positive value before further processing. For ESP-IDF v5.4 and later, users are advised to upgrade to a patched version of ESP-IDF to take advantage of the built-in mitigation.

Exploit

Fix

RCE

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

CVE-2025-52471

GHSA-HQHH-CP47-FV5G

Affected Products

Esp-Idf

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52471.json · Exploit
• https://github.com/espressif/esp-idf/commit/edc227c5eaeced999b5212943a9434379f8aad80 · Patch
• https://github.com/espressif/esp-idf/commit/d6ec5a52255b17c1d6ef379e89f9de2c379042f8 · Patch
• https://github.com/espressif/esp-idf/commit/b1a379d57430d265a53aca13d59ddfbf2e7ac409 · Patch
• https://github.com/espressif/esp-idf/commit/df7757d8279871fa7a2f42ef3962c6c1ec88b8a2 · Patch
• https://github.com/espressif/esp-idf/commit/d4dafbdc3572387cd4f9a62b776580bc4ac3bde7 · Patch
• https://github.com/espressif/esp-idf/security/advisories/GHSA-hqhh-cp47-fv5g · Patch
• https://github.com/espressif/esp-idf/commit/c5fc81917805f99e687c81cc56b68dc5df7ef8b5 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-52471 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52471 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1937642229541052624 · Twitter Post
• https://t.me/cveNotify/149576 · Telegram Post
• https://t.me/cvetracker/26974 · Telegram Post
• https://twitter.com/CVEnew/status/1937606226516295758 · Twitter Post