Loading story…
ESPHome disclosed multiple vulnerabilities in its dashboard component that exposed authenticated users to arbitrary file access and stored cross-site scripting, with the most severe issue allowing remote attackers to read and write files under the configuration directory through the "edit configuration file" API. The path traversal flaw, tracked as CVE-2024-27081 / GHSA-8p25-3q46-8q2p, affected version 2023.12.9 and could expose esphome.json, firmware source code, Wi-Fi credentials, fallback hotspot credentials, OTA passwords, and API encryption keys. In command-line installations, attackers could also modify Python scripts used during firmware compilation and flashing, creating a path to remote code execution on the host running the dashboard.
A separate stored XSS bug, CVE-2024-27287, affected versions from 2023.12.9 through 2024.2.1 and stemmed from the /edit endpoint returning unsanitized user-controlled content as HTML. An authenticated attacker could inject JavaScript into a configuration file and trigger execution when another authenticated user opened a crafted /edit?configuration= link, enabling actions in the victim's session, access to sensitive data, configuration tampering, and firmware flashing on managed boards; the report also noted insufficient cookie protections that could aid session theft. ESPHome patched the file-write issue in version 2024.2.1 and the XSS issue in 2024.2.2, and the advisories said chaining these flaws with additional weaknesses could lead to unauthenticated remote code execution against the machine hosting the dashboard.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
ESPHome publicly disclosed CVE-2024-27287, detailing a stored XSS issue that could let an authenticated attacker execute JavaScript in another authenticated user's session via a crafted configuration file. Successful exploitation could enable actions on behalf of the victim, access to sensitive information, configuration changes, and firmware flashing on managed boards.
ESPHome proposed a patch for CVE-2024-27287, a stored cross-site scripting vulnerability in the dashboard edit configuration file API, and the fix was validated the same day. The flaw affected versions from 2023.12.9 up to but not including 2024.2.2.
ESPHome published a security advisory for CVE-2024-27081 describing authenticated arbitrary file access in the dashboard component and warning that chaining with other flaws could enable unauthenticated remote code execution. The advisory credited the Spike Reply Cybersecurity Team for reporting the issue.
ESPHome fixed CVE-2024-27081, a path traversal issue in the dashboard edit configuration API affecting version 2023.12.9. The patch was made on 2024-02-22 and released in ESPHome 2024.2.1, addressing authenticated arbitrary file read/write that could lead to remote code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
lessonsec.com
Open sourcelessonsec.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two **stored cross-site scripting (XSS)** vulnerabilities, `CVE-2026-33044` in the **Map card** and `CVE-2026-33045` in the **History-Graph card**, were disclosed in Home Assistant. The flaws allow an attacker with low privileges to inject JavaScript that executes in an authenticated victim’s browser session when the affected dashboard content is viewed. Because the code runs with the victim’s permissions, attackers can steal session tokens, access browser local storage, and abuse authenticated REST API or WebSocket connections. The impact can escalate from session hijacking to full administrative compromise when the victim has elevated privileges. Reported abuse paths include generating long-lived access tokens, creating new administrator accounts, changing passwords, altering system configurations, and disabling security integrations. The compromise may also extend beyond the application itself, potentially giving attackers control over connected smart home devices, alarm systems, and in some deployments the underlying host, with `CVE-2026-33045` rated **CVSS v4.0 7.3** and both issues described as high impact despite requiring user interaction.
Jun 29, 2026
Galaxy Software Services' **Vitals ESP** is affected by two high-severity vulnerabilities that could let remote attackers access sensitive functions and elevate privileges. **CVE-2026-4640** is a **missing authentication** flaw (`CWE-306`) that allows **unauthenticated** attackers to remotely execute certain functions and obtain sensitive information, with CVSS vectors indicating network-based exploitation, low attack complexity, and no required user interaction or privileges. A second issue, **CVE-2026-4639**, is an **incorrect authorization** vulnerability (`CWE-863`) that allows **authenticated** remote attackers to perform administrative functions and escalate privileges. TWCERT/CC published references for both flaws in English and Chinese, and the scoring for each indicates material risk to confidentiality, integrity, and availability in deployments of Vitals ESP.
Jun 29, 2026
A series of critical and high-severity vulnerabilities affecting a diverse set of software products were publicly disclosed in October 2025. Epsilon RH by Grupo Castilla was found to have a SQL injection vulnerability (CVE-2025-41028) that allows attackers to manipulate the database by sending crafted POST requests to the 'sEstadoUsr' parameter in the '/epsilonnetws/WSAvisos.asmx' endpoint. Lanscope Endpoint Manager (CVE-2025-61932) was reported to have an improper origin verification flaw, enabling attackers to execute arbitrary code via specially crafted packets, though remote exploitation is not possible. Galaxy Software Services Vitals ESP Forum Module (CVE-2025-31342) was discovered to allow remote authenticated users to upload dangerous files, leading to arbitrary command execution. Fsas Technologies Inc.'s ETERNUS SF (CVE-2025-62577) contains incorrect default permissions, allowing low-privileged users to obtain database credentials and potentially escalate privileges to execute OS commands as an administrator. Excellent Infotek's Document Management System (CVE-2025-11948) is vulnerable to unauthenticated arbitrary file upload, enabling attackers to deploy web shells and execute code on the server. Vvveb CMS up to version 1.0.5 is susceptible to authenticated code injection via its Code Editor, allowing attackers to modify files and achieve remote code execution. The Theme Editor plugin for WordPress (CVE-2025-9890) is vulnerable to cross-site request forgery, which can be exploited to achieve remote code execution if an administrator is tricked into clicking a malicious link. The PPOM plugin for WooCommerce (CVE-2025-11391) allows unauthenticated arbitrary file uploads, posing a severe risk to affected e-commerce sites. The Appointments plugin for WordPress (CVE-2017-20206) and the Flickr Gallery plugin (CVE-2017-20207) both suffer from unauthenticated PHP object injection vulnerabilities, which have been actively exploited to create backdoors using the WP_Theme() class. RegistrationMagic (CVE-2017-20208) is also affected by a PHP object injection flaw, allowing attackers to fetch and install remote files. Finally, BLU-IC2 and BLU-IC4 devices (CVE-2025-11925) have an API that returns an incorrect Content-Type header, potentially enabling HTML/JavaScript injection in responses. Each of these vulnerabilities presents a significant risk, with several allowing remote code execution, privilege escalation, or the installation of persistent backdoors. The affected products span web applications, content management systems, endpoint management tools, and specialized enterprise software. Security teams are advised to review the specific advisories, apply patches or mitigations where available, and monitor for signs of exploitation, as several vulnerabilities have been reported as actively exploited in the wild. The diversity and severity of these disclosures underscore the ongoing need for rigorous vulnerability management and timely response to public advisories.
Jun 29, 2026