ESPHome 2025.8.0 web_server incorrect implementation of authentication algorithm

Summaryinfo

A vulnerability was found in ESPHome 2025.8.0 and classified as critical. This impacts an unknown function of the component web_server. Executing a manipulation can lead to incorrect implementation of authentication algorithm. The identification of this vulnerability is CVE-2025-57808. The attack needs to be done within the local network. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability was found in ESPHome 2025.8.0. It has been declared as critical. This vulnerability affects an unknown code of the component web_server. The manipulation with an unknown input leads to a incorrect implementation of authentication algorithm vulnerability. The CWE definition for the vulnerability is CWE-303. The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.

The advisory is shared for download at github.com. This vulnerability was named CVE-2025-57808 since 08/20/2025. The exploitation appears to be easy. The attack needs to be initiated within the local network. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 2025.8.1 eliminates this vulnerability. Applying the patch 2aceb56606ec8afec5f49c92e140c8050a6ccbe5 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• ESPHome

Version

• 2025.8.0

License

• open-source

Website

• Product: https://github.com/esphome/esphome/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion