CVE-2025-57808
Description
A vulnerability has been identified in ESPHome’s web_server component on the ESP-IDF platform where the HTTP basic authentication check (AsyncWebServerRequest::authenticate) can be bypassed. Due to incorrect comparison of the base64-encoded Authorization header value, authentication succeeds if the client provides either an empty string or a substring of the correct user:password credential. As a result, an attacker on the adjacent network can gain unauthorized access to web_server functionality — including over-the-air (OTA) firmware updates if enabled — without knowing valid credentials.
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
Until a fix is applied, users should disable the web_server component on ESP-IDF devices, especially when OTA updates are enabled. Where disabling is not feasible, ensure devices are isolated from untrusted networks (e.g., place behind a firewall, restrict local access, or use VPN). Users are strongly advised not to expose the vulnerable web_server to the internet or untrusted clients until proper authentication handling is patched.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
