CVE-2024-27287 json
ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API
published 2024-03-06 2 y ago modified 2026-07-07 4 mo ago also EUVD-2024-0886 , GHSA-9p43-hj5j-96h5 , PYSEC-2026-1329
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
ESPHome is a system to control your ESP8266/ESP32 for Home Automation systems. Starting in version 2023.12.9 and prior to version 2024.2.2, editing the configuration file API in dashboard component of ESPHome version 2023.12.9 (command line installation and Home Assistant add-on) serves unsanitized data with `Content-Type: text/html; charset=UTF-8`, allowing a remote authenticated user to inject arbitrary web script and exfiltrate session cookies via Cross-Site scripting. It is possible for a malicious authenticated user to inject arbitrary Javascript in configuration files using a POST request to the /edit endpoint, the configuration parameter allows to specify the file to write. To trigger the XSS vulnerability, the victim must visit the page` /edit?configuration=[xss file]`. Abusing this vulnerability a malicious actor could perform operations on the dashboard on the behalf of a logged user, access sensitive information, create, edit and delete configuration files and flash firmware on managed boards. In addition to this, cookies are not correctly secured, allowing the exfiltration of session cookie values. Version 2024.2.2 contains a patch for this issue.
Patch / fix
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
| NVD | 3.1 | 8.7 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N |
| OSV | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | esphome | >=2023.12.9, <2024.2.2 |
2024.2.2 |
Affected products
- esphome esphome
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
github.com
/esphome/esphome/commit/37d2b3c7977a4ccbec59726ca7549cb776661455
web, patch
-
github.com
/esphome/esphome/security/advisories/GHSA-9p43-hj5j-96h5
web, technical-description, vendor-advisory
-
github.com
/esphome/esphome
package
-
pypi.org
/project/esphome
package
-
github.com
/advisories/GHSA-9p43-hj5j-96h5
advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-27287
advisory
Sources
- CVE List CVE-2024-27287
- GitHub Advisory GHSA-9p43-hj5j-96h5
- NVD CVE-2024-27287
- OSV PYSEC-2026-1329
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.