PT-2025-28253 · Arduino · Arduino-Esp32

Jlleitschuh · Published 2025-07-07 · Updated 2025-07-08 · CVE-2025-53540

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: arduino-esp32 versions prior to 3.2.1

Description: The issue affects several OTA update examples and the HTTPUpdateServer implementation in the arduino-esp32 core, allowing an attacker to upload and execute arbitrary firmware due to a lack of Cross-Site Request Forgery (CSRF) protection for firmware uploads via POST requests. This results in remote code execution (RCE).

Recommendations: For versions prior to 3.2.1, update to version 3.2.1 to resolve the issue. As a temporary workaround, consider disabling the OTA update feature until the patch is applied. Restrict access to the update endpoints to minimize the risk of exploitation. Avoid using the HTTPUpdateServer implementation until the issue is resolved.

Exploit

Fix

RCE

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

BDU:2025-14626

CVE-2025-53540

GHSA-9VFW-WX65-C872

Affected Products

Arduino-Esp32

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53540.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-53540 · Security Note
• https://bdu.fstec.ru/vul/2025-14626 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53540 · Vendor Advisory
• https://github.com/espressif/arduino-esp32/commit/f4fdecc60c465384e465a4b1d2bd1eac8f67912e · Note
• https://github.com/espressif/arduino-esp32/security/advisories/GHSA-9vfw-wx65-c872 · Note
• https://twitter.com/VulmonFeeds/status/1942404332491513900 · Twitter Post
• https://twitter.com/CVEnew/status/1942307938875457992 · Twitter Post