ESPHome Vulnerability Allows Unauthorized Access to Smart Devices

A critical authentication bypass flaw in ESPHome’s ESP-IDF web server component allows unauthorized users on the same local network to access and control ESPHome devices without valid credentials, according to the article. The vulnerability, CVE-2025-57808, undermines Basic Authentication by accepting empty or partially correct Authorization headers, with ESPHome version 2025.8.0 identified as affected and a patch released in 2025.8.1.

Researchers demonstrated that the server can grant access by comparing only the initial bytes of the provided credentials rather than the full base64 token, and even an empty Authorization value can bypass the check. In a proof-of-concept, a substring of a password or a single character could suffice for entry, highlighting the risk to devices running on ESP-IDF with the web_server component enabled, including potential OTA and configuration exposure.

Mitigations include upgrading to 2025.8.1, disabling the web_server component, restricting network access, and applying the patch as soon as possible, according to GitHub Security Advisory GHSA-mxh2-ccgj-8635.