CVE-2021-41104: web_server allows OTA update without checking user defined basic auth username & password
Impact
Anyone with webserver enabled and HTTP basic auth configured on 2021.9.1 or older
webserver allows OTA update without checking user defined basic auth username & password
Patches
Patch released in 2021.9.2
Workarounds
Disable/remove webserver
Other sources
ESPHome is a system to control the ESP8266/ESP32. Anyone with webserver enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which webserver allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove webserver.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/esphometo a version that resolves this vulnerability.Fixed in 2021.9.2 - Upgrade
Upgrade
ESPHometo a version that resolves this vulnerability.Fixed in 2021.9.2 - Compensating control
As a workaround, disable or remove `web_server` when `web_server` is enabled and HTTP basic auth is configured on ESPHome versions `2021.9.1` or older.
Event History
Frequently Asked Questions
What is CVE-2021-41104?
CVE-2021-41104 is a vulnerability in ESPHome that allows over-the-air (OTA) updates without checking user-defined basic auth username and password.
How does CVE-2021-41104 affect ESPHome?
CVE-2021-41104 affects ESPHome version 2021.9.1 or older with web_server enabled and HTTP basic auth configured.
What is the severity of CVE-2021-41104?
The severity of CVE-2021-41104 is high with a severity value of 7.5.
How can I fix CVE-2021-41104?
To fix CVE-2021-41104, you should update ESPHome to version 2021.9.2 or newer.
Where can I find more information about CVE-2021-41104?
You can find more information about CVE-2021-41104 on the GitHub page for ESPHome and in the provided references.