CVE-2025-57808
High
Description
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
SeverityHigh
CVSS8.1
Exploit probability—
ProductEsphome Firmware
PublishedSep 2, 2025
First seenSep 2, 2025
Weakness typeCWE-303CWE-303
How to fix
Update
- esphome2025.8.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| esphome esphome_firmware | 2025.8.0 | — |
| esphomePyPI | v < 2025.8.1 | 2025.8.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.