CVE-2024-45798criticalCWE-20CWE-78CWE-94

CVE-2024-45798: falha crítica em espressif arduino-esp32

Multiple Poisoned Pipeline Execution (PPE) vulnerabilities

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar arduino-esp32

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 10epss 0.9%
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. The `arduino-esp32` CI is vulnerable to multiple Poisoned Pipeline Execution (PPE) vulnerabilities. Code injection in `tests_results.yml` workflow (`GHSL-2024-169`) and environment Variable injection (`GHSL-2024-170`). These issue have been addressed but users are advised to verify the contents of the downloaded artifacts.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
espressif · arduino-esp32
CVEs relacionadas — espressif arduino-esp32

No mesmo produto, das mais perigosas para as menos.

CVE-2026-42854CRITICALarduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCEEPSS 0.6%CVE-2025-53007HIGHarduino-esp32 vulnerable to CRLF injection in WebServer.cppEPSS 0.5%CVE-2026-42855HIGHarduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attackEPSS 0.4%CVE-2025-53540HIGHCSRF Vulnerability in Firmware Update Endpoints Allows Remote Code ExecutionEPSS 0.3%CVE-2026-41429HIGHImproper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruptionEPSS 0.3%