CVE-2024-27081 ESPHome remote code execution via arbitrary file write
Authenticated attackers can read and write arbitrary files via path traversal in the dashboard API, leading to remote code execution on ESPHome devices.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-27081?
CVE-2024-27081 is a high-severity path traversal vulnerability in esphome, published on 26 Feb 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. This vulnerability is patched in 2024.2.1.
Weakness: CWE-22
Which versions are affected by CVE-2024-27081?
3 open source packages ship an affected version, including esphome. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
esphome PyPI | From 2023.12.9 | 2024.2.1 |
esphome PyPI | From 2023.12.9 | 2024.2.1 |
esphome PyPI | From 2023.12.9 | 2024.2.1 |
Products include Esphome Esphome.
How do I fix CVE-2024-27081?
Upgrade esphome to 2024.2.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-27081 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-27081 exists.
Other vulnerabilities in esphome
Sources
Also known as GHSA-8p25-3q46-8q2p, PYSEC-2026-1328.