CVE-2021-41104

Name of the Vulnerable Software and Affected Versions ESPHome versions 2021.9.1 and earlier

Description The issue affects ESPHome, a system to control the ESP8266/ESP32, where the web server allows over-the-air (OTA) updates without checking user-defined basic auth username and password when HTTP basic auth is configured. This issue is patched in version 2021.9.2.

Recommendations For ESPHome versions 2021.9.1 and earlier, update to version 2021.9.2 to resolve the issue. As a temporary workaround, consider disabling or removing the web server to minimize the risk of exploitation.