TI-2024-17944 CVE-2024-27081 · GHSA-8p25-3q46-8q2p
ESPHome remote code execution via arbitrary file write
Priority HIGH 73
ESPHome is a system to control your ESP8266/ESP32.
esphome
Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9
Exploited now
esphome records in CISA KEVNo esphome vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
10 records
TI-2025-35691 CVE-2025-57808 · GHSA-mxh2-ccgj-8635
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
Priority HIGH 70
ESPHome is a system to control microcontrollers remotely through Home Automation systems.
TI-2024-19201 CVE-2024-29019 · GHSA-5925-88xh-6h99
ESPHome vulnerable to Authentication bypass via Cross site request forgery
Priority HIGH 70
ESPHome is a system to control microcontrollers remotely through Home Automation systems.
TI-2026-42331 CVE-2026-59178 · GHSA-rrxg-g2pf-6hh4
ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade
Priority MEDIUM 50
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software.
TI-2026-19197 CVE-2026-23833 · GHSA-4h3h-63v6-88qx
ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
Priority MEDIUM 49
ESPHome is a system to control microcontrollers remotely through Home Automation systems.
Priority MEDIUM 42
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software.
TI-2024-18126 CVE-2024-27287 · GHSA-9p43-hj5j-96h5
ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API
Priority MEDIUM 41
ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems.
TI-2026-49927 CVE-2026-71259 · GHSA-2g7j-rv69-9w67
ESPHome external_components file:// Scheme Validation Bypass Leading to Remote Code Execution
Priority LOW 38
ESPHome through 2026.7.0-dev contains an operator-precedence bug in the cv.url validator in esphome/config_validation.py.
TI-2021-17945 CVE-2021-41104 · GHSA-48mj-p7x2-5jfm
web_server allows OTA update without checking user defined basic auth username & password
Priority LOW 35
ESPHome is a system to control the ESP8266/ESP32.
TI-2026-49928 CVE-2026-71260 · GHSA-qmjj-2rwx-5ffc
ESPHome web_server Plaintext Password Disclosure via JSON "value" Field
Priority LOW 29
ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component.