How severe is CVE-2025-57808?

CVE-2025-57808 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2025-57808 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (71st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2025-57808?

CVE-2025-57808 affects Esphome Esphome Firmware. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2025-57808?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2025-57808 have an EU (EUVD) identifier?

Yes. CVE-2025-57808 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-26385.

When was CVE-2025-57808 published?

CVE-2025-57808 was published on 2025-09-02 and last updated on 2026-06-17.

CVE-2025-57808

CVE-2025-57808 is a high-severity vulnerability in Esphome Esphome Firmware with a CVSS 3.x base score of 8.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-303.

Key facts

Severity: High (CVSS 3.x base score 8.1)
EPSS exploit prediction: 2% (71st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-26385
Weakness: CWE-303
Affected product: Esphome Esphome Firmware
Published: 2025-09-02
Last modified: 2026-06-17

Description

ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.

Frequently asked questions

What is CVE-2025-57808?: ESPHome is a system to control microcontrollers remotely through Home Automation systems. In version 2025.8.0 in the ESP-IDF platform, ESPHome's web_server authentication check can pass incorrectly when the client-supplied base64-encoded Authorization value is empty or is a substring of the correct value. This allows access to web_server functionality (including OTA, if enabled) without knowing any information about the correct username or password. This issue has been patched in version 2025.8.1.
How severe is CVE-2025-57808?: CVE-2025-57808 has a CVSS 3.x base score of 8.1, rated high severity. It is exploitable over an adjacent network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2025-57808 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2025-57808?: CVE-2025-57808 affects Esphome Esphome Firmware. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2025-57808?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2025-57808 have an EU (EUVD) identifier?: Yes. CVE-2025-57808 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-26385.
When was CVE-2025-57808 published?: CVE-2025-57808 was published on 2025-09-02 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:esphome:esphome_firmware:2025.8.0:*:*:*:*:*:*:*

More vulnerabilities in Esphome Esphome Firmware

CVE-2021-41104 — High (CVSS 7.5): ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on…

All CVEs affecting Esphome Esphome Firmware →

Other CWE-303 vulnerabilities

CVE-2025-13390 — Critical (CVSS 10.0): The WP Directory Kit plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…
CVE-2025-12421 — Critical (CVSS 9.9): Mattermost versions 11.0.x <= 11.0.2, 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12 fail to to verify that…
CVE-2025-12419 — Critical (CVSS 9.9): Mattermost versions 10.12.x <= 10.12.1, 10.11.x <= 10.11.4, 10.5.x <= 10.5.12, 11.0.x <= 11.0.3 fail to properly…
CVE-2025-66489 — Critical (CVSS 9.8): Cal.com is open-source scheduling software. Prior to 5.9.8, A flaw in the login credentials provider allows an attacker…
CVE-2025-21311 — Critical (CVSS 9.8): Windows NTLM V1 Elevation of Privilege Vulnerability
CVE-2024-10127 — Critical (CVSS 9.8): Authentication bypass condition in LDAP authentication in M-Files server versions before 24.11 supported usage of…

Browse all CWE-303 vulnerabilities →