CVE-2021-41104

Published: 2021-09-28T16:15Z

Last Modified: 2024-11-21T06:25Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt