CVE-2021-41104 web_server allows OTA update without checking user defined basic auth username & password
Attackers can perform unauthorized OTA updates on ESPHome devices with web_server enabled, bypassing configured HTTP basic authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-41104?
CVE-2021-41104 is a high-severity authentication bypass vulnerability in esphome, published on 28 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.
Weakness: CWE-306
Which versions are affected by CVE-2021-41104?
3 open source packages ship an affected version, including esphome. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
esphome PyPI | All versions | 2021.9.2 |
esphome PyPI | All versions | 2021.9.2 |
esphome PyPI | All versions | 2021.9.2 |
Products include Esphome Esphome Firmware.
How do I fix CVE-2021-41104?
Upgrade esphome to 2021.9.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2021-41104 being exploited?
There is no known exploitation of CVE-2021-41104 in the wild and no public exploit code.
Other vulnerabilities in esphome
Sources
Also known as GHSA-48mj-p7x2-5jfm, PYSEC-2021-351.