CVE-2025-57808 Details
Description
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
A vulnerability in ESPHome version 2025.8.0 on the ESP-IDF platform allows for improper authentication bypass in the web server component. The issue arises because the server's authentication check incorrectly validates base64-encoded Authorization headers that are either empty or only partially correct. This flaw enables access to web server functionalities, including over-the-air (OTA) updates, without knowledge of the correct username or password. The vulnerability has been patched in version 2025.8.1.
Users can update to ESPHome version 2025.8.1 or later, where this vulnerability has been fixed. If an immediate update is not possible, consider disabling the web server component on ESP-IDF devices, especially if OTA updates via the web server are enabled.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Sep 2, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/esphome/esphome/commit/2aceb56606ec8afec5f49c92e140c8050a6ccbe5 | [email protected] | Patch |
| https://github.com/esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| esphome esphome firmware | 2025.8.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 10, 2025 | Initial Analysis | [email protected] |
| Sep 2, 2025 | CVE Modified | CISA-ADP |
| Sep 2, 2025 | New CVE Received | [email protected] |