CVE-2025-57808

CVE-2025-57808 describes an authentication bypass vulnerability in ESPHome's web_server component, specifically affecting version 2025.8.0 when using the ESP-IDF platform. This flaw allows unauthorized access to web_server functionalities, including Over-The-Air (OTA) updates if enabled, by exploiting an incorrect authentication check where an empty or partial base64-encoded Authorization header is accepted. The vulnerability carries a CVSS score of 8.1 (HIGH), indicating a severe risk due to its low attack complexity, network-adjacent attack vector, and high potential for confidentiality and integrity impact without requiring user interaction or privileges. While there is no evidence of active exploitation (KEV: No) or Metasploit modules, Nuclei templates for this high-severity vulnerability are available, suggesting potential for exploit development. Community discussion and media coverage are currently minimal, which is typical for a newly disclosed CVE.