PT-2026-40455 · Espressif Systems · Arduino-Esp32

Published 2026-05-12 · Updated 2026-05-13 · CVE-2026-42855

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions arduino-esp32 versions prior to 3.3.8

Description The WebServer Digest authentication implementation computes the authentication hash using the URI field from the client's Authorization header without verifying that it matches the actual requested URI. This allows an attacker with a valid digest response for one URI to authenticate requests to a different protected URI, bypassing per-resource access control.

Recommendations Update to version 3.3.8.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-42855

Affected Products

Arduino-Esp32

References · 4

• https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42855 · Security Note
• https://twitter.com/VulmonFeeds/status/2054463414479598014 · Twitter Post
• https://t.me/CVEtracker/53548 · Telegram Post