CVE-2025-57808

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CVSS v3.1

8.1 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS

1.57% chance of exploitation in the next 30 days, 74th percentile

Nuclei

high

Published

2025-09-02

Proof-of-concept exploits (2)

• esphome/esphome/security/advisories/GHSA-mxh2-ccgj-8635
• advisories/GHSA-mxh2-ccgj-8635

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-57808.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2024-27081
• CVE-2025-57807
• CVE-2025-5781
• CVE-2025-57803
• CVE-2025-57819
• CVE-2025-57801