Skip to main content

Incorrect Implementation of Authentication Algorithm

CVE-2025-57808

High
8.1/10

Summary

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2023.7.0 through 2025.8.0, in the ESP-IDF platform, ESPHome's 'web_server' authentication check can pass incorrectly when the client-supplied Base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to 'web_server' functionality (including OTA, if enabled) without knowing any information about the correct username or password.

  • LOW
  • ADJACENT NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • NONE

CWE-303 - Incorrect Implementation of Authentication Algorithm

The requirements for the software dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.

References

Advisory Timeline

  • Published