CVE-2025-57808: ESPHome Authentication Bypass Vulnerability

CVE-2025-57808 Overview

CVE-2025-57808 is an authentication bypass vulnerability in ESPHome, a system for controlling microcontrollers through home automation platforms. The flaw affects ESPHome firmware version 2025.8.0 running on the ESP-IDF platform. The web_server authentication check incorrectly accepts requests when the base64-encoded Authorization header is empty or contains a substring of the correct credential value. Attackers on an adjacent network can access the web interface, including Over-the-Air (OTA) update functionality when enabled, without valid credentials. ESPHome released a fix in version 2025.8.1.

Critical Impact
Unauthenticated attackers on the local network can gain full control over ESPHome devices, including firmware replacement through OTA updates.

Affected Products

ESPHome firmware 2025.8.0 on the ESP-IDF platform
Devices with web_server component enabled and credential-based authentication configured
Deployments where OTA updates are exposed through the web server

Discovery Timeline

2025-09-02 - CVE-2025-57808 published to the National Vulnerability Database (NVD)
2025-09-10 - Last updated in NVD database

Technical Details for CVE-2025-57808

Vulnerability Analysis

The vulnerability resides in the ESPHome web_server component's HTTP Basic Authentication handling on the ESP-IDF platform. The authentication routine compares the client-supplied base64-encoded Authorization header value against the expected encoded credential string. The comparison logic returns success when the supplied value is empty or constitutes a prefix or substring of the correct value. Attackers do not need to enumerate or guess the actual username and password. This vulnerability is categorized under [CWE-303]: Incorrect Implementation of Authentication Algorithm. The fix landed in commit 2aceb56606ec8afec5f49c92e140c8050a6ccbe5, which corrects the comparison to require a full, constant-time match of the credential string.

Root Cause

The root cause is a flawed string comparison in the credential validation routine. Instead of verifying that the supplied authorization value equals the expected value in full, the implementation accepts partial matches. An empty Authorization header triggers the same successful code path as a valid credential due to insufficient length and equality checks.

Attack Vector

The attack requires network adjacency, typically meaning the attacker shares the same Wi-Fi or LAN segment as the target ESPHome device. The attacker sends an HTTP request to the web_server endpoint with an empty Authorization: Basic header or a header containing a short substring of the encoded credential. The server returns authenticated content and exposes control endpoints. When OTA is enabled, the attacker can upload arbitrary firmware and persist control over the microcontroller. See the GitHub Security Advisory for the official advisory and the GitHub Commit Update for the patch.

Detection Methods for CVE-2025-57808

Indicators of Compromise

HTTP requests to ESPHome web_server endpoints carrying an empty Authorization header or a truncated Basic auth value followed by a 200 OK response
Unexpected OTA firmware uploads or device reboots not initiated by administrators
New or modified entities, automations, or service calls originating from unfamiliar source IPs on the local network
ESPHome devices reporting firmware versions or build timestamps inconsistent with the managed configuration

Detection Strategies

Inventory all ESPHome devices and identify those running firmware version 2025.8.0 on the ESP-IDF platform
Inspect device logs for successful web_server authentications correlated with malformed or empty Authorization headers
Use network packet capture on IoT VLANs to flag HTTP Basic requests where the credential field is empty or unusually short
Compare running firmware hashes against the expected build artifacts to detect unauthorized OTA replacements

Monitoring Recommendations

Forward ESPHome and network device logs to a centralized SIEM and alert on authentication anomalies
Monitor for outbound connections from ESPHome devices to unexpected destinations after web access events
Track OTA update events and require change-management correlation for every firmware change
Baseline normal web_server access patterns and alert on access from new source addresses

How to Mitigate CVE-2025-57808

Immediate Actions Required

Upgrade all ESPHome firmware to version 2025.8.1 or later and re-flash affected ESP-IDF devices
Temporarily disable the web_server component on production devices until patched firmware is deployed
Disable OTA over the web interface where it is not strictly required for operations
Isolate ESPHome devices on a dedicated VLAN with no inbound access from untrusted client networks

Patch Information

The maintainers patched the authentication routine in ESPHome 2025.8.1. The fix is contained in commit 2aceb56606ec8afec5f49c92e140c8050a6ccbe5, which enforces a full-length credential comparison. Rebuild and flash device firmware using the updated ESPHome release. Refer to the GitHub Security Advisory GHSA-mxh2-ccgj-8635 for vendor guidance.

Workarounds

Remove or comment out the web_server block in device YAML configurations and recompile firmware
Restrict access to device IP addresses with firewall rules limiting traffic to administrative hosts only
Place IoT devices behind a reverse proxy that enforces its own authentication and rate limiting
Rotate any credentials previously configured on exposed devices after patching, in case of prior compromise

bash

# Configuration example: disable web_server in ESPHome YAML
# Remove or comment out the web_server section, then rebuild and flash
#
# web_server:
#   port: 80
#   auth:
#     username: admin
#     password: !secret web_password

# After patching to 2025.8.1, verify firmware version
esphome version
esphome run device.yaml --device <DEVICE_IP>