{"id":"CVE-2021-41104","aliases":["EUVD-2021-0071","GHSA-48mj-p7x2-5jfm","PYSEC-2021-351"],"status":"published","title":"web_server allows OTA update without checking user defined basic auth username \u0026 password","description":"ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username \u0026 password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01213,"percentile":0.68776,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-306"],"published":"2021-09-28T15:15:11Z","modified":"2026-06-17T04:07:52Z","fixes":[{"ecosystem":"PyPI","package":"esphome","fixed_in":["2021.9.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"esphome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.9.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"esphome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.9.2"}]}],"versions":["1.10.1","1.11.0","1.11.0b1","1.11.0b2","1.11.0b3","1.11.1","1.11.2","1.12.0","1.12.0b1","1.12.0b2","1.12.0b3","1.12.0b4","1.12.1","1.12.2","1.13.0","1.13.0b1","1.13.0b2","1.13.0b3","1.13.0b4","1.13.0b5","1.13.0b6","1.13.0b7","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.14.0","1.14.0b1","1.14.0b2","1.14.0b3","1.14.0b4","1.14.0b5","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.0b1","1.15.0b2","1.15.0b3","1.15.0b4","1.15.1","1.15.2","1.15.3","1.16.0","1.16.0b1","1.16.0b2","1.16.0b3","1.16.0b4","1.16.0b5","1.16.0b6","1.16.0b7","1.16.0b8","1.16.1","1.16.2","1.17.0","1.17.0b1","1.17.1","1.17.2","1.18.0","1.18.0b1","1.18.0b2","1.18.0b3","1.18.0b4","1.19.0","1.19.0b1","1.19.0b2","1.19.0b3","1.19.0b4","1.19.0b5","1.19.0b6","1.19.0b7","1.19.1","1.19.2","1.19.3","1.19.4","1.20.0","1.20.0b1","1.20.0b2","1.20.0b3","1.20.0b4","1.20.0b5","1.20.0b6","1.20.1","1.20.2","1.20.3","1.20.4","1.21.0b1","1.21.0b2","1.21.0b3","2021.8.0","2021.8.1","2021.8.2","2021.9.0","2021.9.0b1","2021.9.0b2","2021.9.0b3","2021.9.0b4","2021.9.0b5","2021.9.1"]},{"source":"osv","ecosystem":"PyPI","package":"esphome","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"2234f6aacf8cc653307fed80f3750317a82c4f83"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2021.9.2"}]}],"versions":["1.10.1","1.11.0","1.11.0b1","1.11.0b2","1.11.0b3","1.11.1","1.11.2","1.12.0","1.12.0b1","1.12.0b2","1.12.0b3","1.12.0b4","1.12.1","1.12.2","1.13.0","1.13.0b1","1.13.0b2","1.13.0b3","1.13.0b4","1.13.0b5","1.13.0b6","1.13.0b7","1.13.1","1.13.2","1.13.3","1.13.4","1.13.5","1.13.6","1.14.0","1.14.0b1","1.14.0b2","1.14.0b3","1.14.0b4","1.14.0b5","1.14.1","1.14.2","1.14.3","1.14.4","1.14.5","1.15.0","1.15.0b1","1.15.0b2","1.15.0b3","1.15.0b4","1.15.1","1.15.2","1.15.3","1.16.0","1.16.0b1","1.16.0b2","1.16.0b3","1.16.0b4","1.16.0b5","1.16.0b6","1.16.0b7","1.16.0b8","1.16.1","1.16.2","1.17.0","1.17.0b1","1.17.1","1.17.2","1.18.0","1.18.0b1","1.18.0b2","1.18.0b3","1.18.0b4","1.19.0","1.19.0b1","1.19.0b2","1.19.0b3","1.19.0b4","1.19.0b5","1.19.0b6","1.19.0b7","1.19.1","1.19.2","1.19.3","1.19.4","1.20.0","1.20.0b1","1.20.0b2","1.20.0b3","1.20.0b4","1.20.0b5","1.20.0b6","1.20.1","1.20.2","1.20.3","1.20.4","1.21.0b1","1.21.0b2","1.21.0b3","2021.8.0","2021.8.1","2021.8.2","2021.9.0","2021.9.0b1","2021.9.0b2","2021.9.0b3","2021.9.0b4","2021.9.0b5","2021.9.1"]}],"products":[{"vendor":"esphome","product":"esphome"},{"vendor":"esphome","product":"esphome_firmware"}],"references":[{"url":"https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","web","advisory"]},{"url":"https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1e","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://github.com/esphome/esphome/releases/tag/2021.9.2","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/esphome/esphome/commit/be965a60eba6bb769e2a5afdbc8eed132f077a59","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-41104","tags":["advisory"]},{"url":"https://github.com/esphome/esphome/pull/2409","tags":["web"]},{"url":"https://github.com/esphome/esphome/commit/2234f6aacf8cc653307fed80f3750317a82c4f83","tags":["web","fix"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/esphome/PYSEC-2021-351.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-48mj-p7x2-5jfm"},{"url":"https://github.com/esphome/esphome","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-41104","title":"web_server allows OTA update without checking user defined basic auth username \u0026 password","description":"ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username \u0026 password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.","status":"published","published":"2021-09-28T15:15:11Z","modified":"2024-08-04T02:59:31.35Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:32:59.430294Z"}],"euvd":[{"id":"EUVD-2021-0071","description":"ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username \u0026 password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.","status":"published","published":"2021-09-28T15:15:11Z","modified":"2024-08-04T02:59:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T03:24:19.242491Z"}],"ghsa":[{"id":"GHSA-48mj-p7x2-5jfm","title":"Basic auth bypass in esphome","description":"### Impact\n\nAnyone with web_server enabled and HTTP basic auth configured on 2021.9.1 or older\n\n`web_server` allows OTA update without checking user defined basic auth username \u0026 password\n\n### Patches\n\nPatch released in 2021.9.2\n\n### Workarounds\n\nDisable/remove `web_server`\n","status":"published","published":"2021-09-29T17:09:14Z","modified":"2024-09-20T17:35:23Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2021-41104","description":"ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username \u0026 password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.","status":"published","published":"2021-09-28T16:15:08.413Z","modified":"2026-06-17T04:07:52.94Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T14:06:59.314106Z"}],"osv":[{"id":"GHSA-48mj-p7x2-5jfm","title":"Basic auth bypass in esphome","description":"### Impact\n\nAnyone with web_server enabled and HTTP basic auth configured on 2021.9.1 or older\n\n`web_server` allows OTA update without checking user defined basic auth username \u0026 password\n\n### Patches\n\nPatch released in 2021.9.2\n\n### Workarounds\n\nDisable/remove `web_server`\n","status":"published","published":"2021-09-29T17:09:14Z","modified":"2026-05-04T08:45:54.767868579Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"PYSEC-2021-351","description":"ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username \u0026 password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.","status":"published","published":"2021-09-28T16:15:00Z","modified":"2023-11-08T04:06:51.299405Z","updated_at":"2026-11-02T15:52:52.682031Z"}]}}