Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).

Impact

Anyone with webserver enabled and HTTP basic auth configured on 2021.9.1 or older

webserver allows OTA update without checking user defined basic auth username & password

Patches

Patch released in 2021.9.2

Workarounds

Disable/remove webserver

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled namelen field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.

Constant Time Issue with Xtensa-based ESP32 and X22519

An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and secure boot keys, by injecting a glitch into the power supply of the chip shortly after reset.