CyberRota Analysis
AI-GeneratedESPHome versions up to 2026.7.0-dev are vulnerable due to the web_server component exposing plaintext passwords through its JSON output, despite masking them in the "state" field. This flaw allows attackers on the local network to retrieve sensitive information, such as WiFi credentials and API tokens, by accessing specific endpoints without authentication. Organizations using ESPHome should prioritize addressing this vulnerability to mitigate the risk of unauthorized access to their network and sensitive data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_ (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value/set_json_value.