CVE-2025-57808 - CVE House
Back to Database
Status published High CVE-2025-57808

ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header

Vulnerability Description

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-57808

Credits & Attribution

No credits recorded in the NVD database.

References

More from esphome

View All →
CVE-2024-29019
ESPHome vulnerable to Authentication bypass via Cross site request forgery
High 8.1
CVE-2024-27287
ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API
Medium 6.5
CVE-2024-27081
ESPHome remote code execution via arbitrary file write
High 7.2
CVE-2021-41104
web_server allows OTA update without checking user defined basic auth username & password
High 7.5

Affected Vendor

Affected Software

esphome
Vulnerable Versions:
= 2025.8.0

Timeline

Official Publish: September 2nd, 2025
Last Modified: September 2nd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-303

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.