Loading story…
Compass Security demonstrated an unauthenticated exploit chain at Pwn2Own Cork 2025 that achieved root access on a Home Assistant Green host through the Music Assistant add-on 2.6.0. The add-on exposed its web interface on port 8095 without authentication, allowing playlist-update requests to be abused for arbitrary file writes. Researchers converted this primitive into Python code execution in the Music Assistant container by planting a malicious .pth file, a Python site-configuration mechanism processed during interpreter startup.
Because the container used host networking, the researchers captured plaintext internal Home Assistant Supervisor API traffic and stole a privileged Home Assistant Core bearer token. They used the token to install a malicious privileged add-on with Docker API access, then escaped through Docker to obtain root on Home Assistant OS. Music Assistant 2.7.0 remediates the initial attack path by requiring authentication on port 8095 and rejecting playlist file-path updates for filesystem providers; operators should upgrade and review exposed add-ons, privileged tokens, and Docker-capable integrations.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
At Pwn2Own Cork 2025, researchers demonstrated an unauthenticated exploit chain against a Home Assistant Green device, progressing from the Music Assistant add-on to root control of the Home Assistant OS host. The successful entry earned $20,000 and four Master of Pwn points.
Music Assistant version 2.7.0 added authentication to its port 8095 web interface and rejected filesystem-provider playlist file-path updates, mitigating the unauthenticated access and arbitrary-file-write primitives used in the exploit chain.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed a Home Assistant vulnerability in the Wyoming integration's **announce** feature that let attackers abuse FFmpeg input handling to inject arguments and access local files. By leveraging FFmpeg pseudo-protocols such as `file:`, `concat:`, and `subfile:`, the attack could assemble synthetic audio streams from local byte ranges, enabling exfiltration of sensitive data including `/proc/self/environ` and the `SUPERVISOR_TOKEN`. With the recovered supervisor token, an attacker could call Home Assistant's supervisor API and execute commands as **root**, potentially compromising both the Home Assistant instance and its host system. The attack required control of a paired Wyoming Assist satellite and a valid Home Assistant API token, making local network or previously established access a likely prerequisite. Home Assistant addressed the issue in **Core 2026.6.2** by enforcing a strict FFmpeg protocol allowlist and applying it before the input argument to block parsing bypasses.
Sep 3, 2026
Two **stored cross-site scripting (XSS)** vulnerabilities, `CVE-2026-33044` in the **Map card** and `CVE-2026-33045` in the **History-Graph card**, were disclosed in Home Assistant. The flaws allow an attacker with low privileges to inject JavaScript that executes in an authenticated victim’s browser session when the affected dashboard content is viewed. Because the code runs with the victim’s permissions, attackers can steal session tokens, access browser local storage, and abuse authenticated REST API or WebSocket connections. The impact can escalate from session hijacking to full administrative compromise when the victim has elevated privileges. Reported abuse paths include generating long-lived access tokens, creating new administrator accounts, changing passwords, altering system configurations, and disabling security integrations. The compromise may also extend beyond the application itself, potentially giving attackers control over connected smart home devices, alarm systems, and in some deployments the underlying host, with `CVE-2026-33045` rated **CVSS v4.0 7.3** and both issues described as high impact despite requiring user interaction.
Jun 29, 2026
Public advisories disclosed two **root-level remote code execution** vulnerabilities in **atvise SCADA 3.13.0** from atvise GmbH / Bachmann Visutec, affecting deployments with the `WEBACCESS` module enabled. One flaw allows **pre-authentication** compromise through an **OPC UA authentication bypass** on port `4840`, which can be chained with WebMI script tampering and anonymous request paths to execute arbitrary commands as `root`. The second issue is an **authenticated default-credential RCE** in WebHMI/WebMI, where a built-in `root` account ships with an empty password and a login branch can grant a superuser session without proper password verification while that default state remains. Researchers said successful exploitation can lead to **complete host compromise**, including arbitrary command execution, file access, and manipulation of SCADA control logic and node values. The advisory noted that `WEBACCESS` is normally loaded in licensed production deployments, increasing practical exposure, and said **proof-of-concept code** and full technical analysis were released publicly through Full Disclosure and separate write-ups covering the OPC UA unauthenticated attack path and the WebMI default-credential RCE.
Aug 6, 2026