CVE-2024-27081 - CVE House
Back to Database
Status published High CVE-2024-27081

ESPHome remote code execution via arbitrary file write

Vulnerability Description

ESPHome is a system to control your ESP8266/ESP32. A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible. This vulnerability is patched in 2024.2.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-27081

Credits & Attribution

No credits recorded in the NVD database.

References

More from esphome

View All →
CVE-2025-57808
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
High 8.1
CVE-2024-29019
ESPHome vulnerable to Authentication bypass via Cross site request forgery
High 8.1
CVE-2024-27287
ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API
Medium 6.5
CVE-2021-41104
web_server allows OTA update without checking user defined basic auth username & password
High 7.5

Affected Vendor

Affected Software

esphome
Vulnerable Versions:
= 2023.12.9

Timeline

Official Publish: February 26th, 2024
Last Modified: August 27th, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact