ESPHome vulnerable to Authentication bypass via Cross site request forgery
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-352.
Summary
ESPHome is a system to control microcontrollers remotely through Home Automation systems. API endpoints in dashboard component of ESPHome version 2023.12.9 (command line installation) are vulnerable to Cross-Site Request Forgery (CSRF) allowing remote attackers to carry out attacks against a logged user of the dashboard to perform operations on configuration files (create, edit, delete). It is possible for a malicious actor to create a specifically crafted web page that triggers a cross site request against ESPHome, this allows bypassing the authentication for API calls on the platform. This vulnerability allows bypassing authentication on API calls accessing configuration file operations on the behalf of a logged user. In order to trigger the vulnerability, the victim must visit a weaponized page. In addition to this, it is possible to chain this vulnerability with GHSA-9p43-hj5j-96h5/ CVE-2024-27287 to obtain a complete takeover of the user account. Version 2024.3.0 contains a patch for this issue.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| esphome | esphome | 2023.12.9 to before 2024.3.0 | 2024.3.0 | Patch available | CNA |
| — | esphome (PyPI) | 2023.12.9 to before 2024.3.0 | 2024.3.0 | Patch available | GHSA-5925-88xh-6h99 |
- esphome Vendoresphome Affected 2023.12.9 to before 2024.3.0 Fixed in 2024.3.0 Patch available CNA
- esphome (PyPI) Vendor— Affected 2023.12.9 to before 2024.3.0 Fixed in 2024.3.0 Patch available GHSA-5925-88xh-6h99
Remediation
- Fix · CNA esphome (esphome) Fixed in 2024.3.0
- Fix · GHSA-5925-88xh-6h99 esphome (PyPI) Fixed in 2024.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-29019
- 2026-10-03 Alias added: GHSA-5925-88xh-6h99
References
Advisory 2
Other 6
- https://github.com/esphome/esphome/security/advisories/GHSA-5925-88xh-6h99
- https://github.com/esphome/esphome/pull/6396
- https://github.com/esphome/esphome/pull/6397
- https://github.com/esphome/esphome/commit/c56c40cb824e34ed2b89ba1cb8a3a5eb31459c74
- https://github.com/esphome/esphome
- https://github.com/esphome/esphome/releases/tag/2024.3.0
More esphome vulnerabilities
- TI-2024-17944 ESPHome remote code execution via arbitrary file write CVSS 3.1HIGH 8.8
- TI-2025-35691 ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header CVSS 3.1HIGH 8.1
- TI-2026-42331 ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade CVSS 3.1CRITICAL 9.8
- TI-2026-19197 ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component CVSS 4.0LOW 1.7
- TI-2026-81983 ESPHome Device Builder ingress site skips authentication on LAN CVSS 3.1HIGH 8.8
- TI-2024-18126 ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API CVSS 3.1HIGH 8.7
Sources
- CVE-2024-29019 · CVE Program
- CVE-2024-29019 · NVD
- FIRST EPSS
- GHSA-5925-88xh-6h99 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences