CVE-2021-41104highCWE-306

CVE-2021-41104: fallo de gravedad alta en esphome

web_server allows OTA update without checking user defined basic auth username & password

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear esphome+ Monitorear esphome

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.5epss 1.2%
ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
esphome · esphome
CVEs relacionadas — esphome

En el mismo producto, de las más peligrosas a las menos.

CVE-2025-57808HIGHESP-IDF web_server basic auth bypass using empty or incomplete Authorization headerEPSS 1.5%CVE-2024-27081HIGHESPHome remote code execution via arbitrary file writeEPSS 1.5%CVE-2024-27287MEDIUMESPHome vulnerable to stored Cross-site Scripting in edit configuration file APIEPSS 0.7%CVE-2026-23833LOWESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API componentEPSS 0.3%CVE-2026-71260MEDIUMESPHome web_server Plaintext Password Disclosure via JSON "value" FieldEPSS 0.3%CVE-2024-29019HIGHESPHome vulnerable to Authentication bypass via Cross site request forgeryEPSS 0.3%