- Yama var
- Son 7 gün
- CWE-1327
CVE-2026-59177
ESPHome Device Builder allows unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces
- Yayımlandı
- Güncellendi
- 28 Eki 2026
- Açık yaşı
- 0 gün
- Kaydı açan
- GitHub_M
Özet
Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.
ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to 1.0.10, the Home Assistant add-on's trusted ingress site binds to 0.0.0.0 while intentionally skipping dashboard authentication because the supervisor is expected to authenticate requests upstream. Host networking, required for mDNS, also binds this no-auth site to the Home Assistant host's LAN interface. Any device on that local network can therefore connect directly to the ingress port, bypass the supervisor, and obtain the full dashboard without credentials or operator misconfiguration. Dashboard capability includes compile-time Python execution through external_components:, shell execution through compile and validation subprocesses, and arbitrary access to configuration and data files, compromising the mounted Home Assistant configuration and managed ESPHome devices. The standalone Docker dashboard and the password-gated public port 6052 are not affected. This issue is fixed in version 1.0.10.
Etkilenen sürümler1 yazılım
| Yazılım | Etkilenen | Düzeltildiği sürüm |
|---|---|---|
| esphome device-builder | < 1.0.10 | 1.0.10 |
Kaynaklar6 kaynak
Kayıt geçmişi
- Yayımlandı