CVE-2024-27081High· 7.2▾ TwilightESPHome vulnerable to remote code execution via arbitrary file write
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.6 · likelihood 0.3 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
1.5%
Last analysed / modified upstream
Security misconfiguration in edit configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation) allows authenticated remote attackers to read and write arbitrary files under the configuration directory rendering remote code execution possible.
It is possible to abuse this path traversal vulnerability both in command line installation and Home Assistant add-on, but it is possible to read and write files only under the configuration directory.
The vulnerability is present and exploitable in the command line installation, but it was not possible to confirm an impact in the home assistant add-on version.
The issue gives read and write access to files under the configuration directory and allows malicious users to write arbitrary code in python scripts executed during the compilation and flashing of firmwares for ESP boards.
If chained with GHSA-9p43-hj5j-96h5 and GHSA-5925-88xh-6h99, this issue could allow an unauthenticated remote user to gain remote code execution on the machine hosting the dashboard.
It also allows accessing sensitive information such as esphome.json and board firmware source code allowing a user to modify the board firmware, and leaking secrets such as: WiFi network credentials, fallback hotspot WiFi credentials, OTA component authentication password and API encryption key.
Spike Reply Cybersecurity Team
esphome >= 2023.12.9, < 2024.2.1Upgrade to a patched release:
esphome 2024.2.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-57808High· 8.1ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
CVE-2024-27287Medium· 6.5esphome vulnerable to stored Cross-site Scripting in edit configuration file API
CVE-2024-29019High· 8.1ESPHome vulnerable to Authentication bypass via Cross site request forgery
CVE-2026-23833MediumESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
CVE-2026-59178Critical· 9.8ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software