Listen to this Post
The Home Assistant ESPHome add-on dashboard serves a trusted ingress site that intentionally skips authentication because the supervisor’s ingress proxy authenticates the browser upstream. The dashboard’s threat model assumes the ingress site is reachable only through the supervisor’s Docker network. However, the ingress site was binding to 0.0.0.0 instead of loopback plus the supervisor gateway. Because the add-on runs in host network mode for mDNS functionality, binding all interfaces also bound the host’s LAN interface. This meant any device on the local network could reach http://
DailyCVE Form:
Platform: Home Assistant ESPHome
Version: 1.0.0 to 1.0.9
Vulnerability: Auth Bypass
Severity: Critical
date: 2026-01-14
Prediction: 2026-01-28
What Undercode Say:
curl http://192.168.1.100:6052/ –head
nmap -p 6052 192.168.1.100
import requests
r = requests.get(‘http://
print(r.status_code)
python3 -c “import socket; s=socket.socket(); s.connect((‘‘, )); print(s.recv(1024))”
Exploit: (Educational Purposes!)
Discover Home Assistant host IP on local network via arp-scan or nmap ping sweep.
Identify ESPHome add-on ingress port through port scanning or by checking Home Assistant supervisor logs.
Access the ingress URL directly without authentication from any LAN device.
Execute arbitrary Python code through dashboard compile functionality using external_components directive.
Access and modify Home Assistant configuration directory mounted by the add-on.
Control all ESPHome devices managed by the compromised add-on instance.
Protection: from this CVE
Upgrade esphome container to version bundling device-builder 1.0.10 or newer.
Restrict access to add-on ingress port via host firewall rules allowing only Home Assistant host and supervisor.
Keep Home Assistant host on trusted LAN segment isolated from untrusted devices.
Monitor network traffic for unauthorized access attempts to ingress port.
Implement network segmentation to isolate IoT devices from Home Assistant management network.
Verify ingress site binds only to 127.0.0.1 and 172.30.32.1 after upgrade.
Impact:
Full compromise of ESPHome add-on including host-equivalent capability.
Unauthenticated attacker gains ability to run arbitrary Python at compile time.
Arbitrary shell command execution through compile and validation subprocesses.
Read and write access to arbitrary files in config and data directories.
Compromise of Home Assistant configuration directory mounted by add-on.
Full control over all ESPHome devices managed by the add-on.
Confidentiality, integrity, and availability all rated High with CVSS base score 8.8.
Exposure present by default on every host-network HA add-on install requiring no operator misconfiguration.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
