CVE-2021-41104
📋 TL;DR
ESPHome versions 2021.9.1 and older with web_server enabled and HTTP basic auth configured are vulnerable to authentication bypass. Attackers can perform over-the-air (OTA) firmware updates without providing valid credentials, potentially compromising ESP8266/ESP32 devices. This affects users who have enabled the web_server component with basic authentication.
💻 Affected Systems
- ESPHome
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could upload malicious firmware to take complete control of the device, potentially creating botnet nodes, stealing data, or disrupting operations.
Likely Case
Unauthorized firmware modification leading to device malfunction, data exfiltration, or lateral movement within the network.
If Mitigated
If proper network segmentation and access controls are in place, impact is limited to the affected device only.
🎯 Exploit Status
Exploitation requires network access to the device's web interface but no authentication credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2021.9.2
Vendor Advisory: https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm
Restart Required: Yes
Instructions:
1. Update ESPHome to version 2021.9.2 or newer. 2. Recompile and flash firmware to affected devices. 3. Verify web_server authentication now properly validates credentials for OTA updates.
🔧 Temporary Workarounds
Disable web_server
allRemove or disable the web_server component from ESPHome configuration
Remove 'web_server:' section from configuration YAML
🧯 If You Can't Patch
- Implement network segmentation to isolate ESP devices from untrusted networks
- Use firewall rules to restrict access to ESP web interfaces to trusted IPs only
🔍 How to Verify
Check if Vulnerable:
Check ESPHome version in device logs or web interface. If version is 2021.9.1 or older AND web_server is enabled with basic auth, device is vulnerable.Check Version:
Check ESPHome logs or web interface for version informationVerify Fix Applied:
After updating to 2021.9.2+, attempt OTA update without valid credentials - it should fail with authentication error.📡 Detection & Monitoring
Log Indicators:
- Unauthorized OTA update attempts
- Failed authentication logs followed by successful OTA
Network Indicators:
- HTTP POST requests to /update endpoint without proper authentication headers
SIEM Query:
source="esphome" AND (event="ota_update" AND NOT auth_success="true")🔗 References
- https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1e
- https://github.com/esphome/esphome/releases/tag/2021.9.2
- https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm
- https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1e
- https://github.com/esphome/esphome/releases/tag/2021.9.2
- https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm
