Security readout for executives and security teams
Plain-English summary
ESPHome devices with the web_server component enabled could accept over-the-air updates without enforcing the configured HTTP basic authentication. For affected versions, this creates a serious device integrity risk because an unauthenticated network-reachable party could update firmware. The vendor patched the issue in 2021.9.2 and named disabling or removing web_server as a workaround.
Executive priority
Treat this as a high-priority remediation for connected device environments. It affects device integrity rather than data theft, but unauthorized firmware updates can undermine trust in automation, monitoring, or physical processes. Prioritize internet-facing or broadly reachable ESPHome devices first.
Technical view
CVE-2021-41104 is a CWE-306 missing authentication issue in ESPHome web_server. Versions before 2021.9.2, including 2021.9.1 and older, can allow OTA updates without validating the user-defined basic auth username and password. The CVSS 3.1 score is 7.5, driven by network reachability, no privileges, no user interaction, and high integrity impact.
Likely exposure
Exposure is limited to ESPHome deployments before 2021.9.2 where web_server is enabled and HTTP basic auth is configured. Risk is highest when the ESPHome web interface is reachable from untrusted networks. The source bundle does not identify CPEs or specific downstream packaged products.
Exploitation context
The provided sources do not show CISA KEV listing or active exploitation. The weakness is still operationally important because OTA update functionality changes device state, and the vulnerable path did not enforce the configured web_server authentication.
Researcher notes
The advisory, CVE record, fix commit, and 2021.9.2 release consistently identify the affected condition and fix version. Evidence is strong for affected versions and mitigation. Evidence is incomplete for exploitation in the wild, downstream products, and environmental prevalence.
Mitigation direction
- Upgrade affected ESPHome deployments to 2021.9.2 or later.
- Disable or remove web_server where immediate upgrade is not possible.
- Restrict network access to ESPHome web_server interfaces until remediated.
- Review vendor advisory and release notes before broad rollout.
Validation and detection
- Inventory ESPHome instances and identify versions older than 2021.9.2.
- Check configurations for enabled web_server and configured basic auth.
- Confirm vulnerable web_server interfaces are not exposed to untrusted networks.
- Verify remediation by confirming version 2021.9.2 or later.
- Track any exceptions where web_server remains enabled before upgrade.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-41104 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N3.93.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfmCVE reference · x_refsource_CONFIRM
- https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1eCVE reference · x_refsource_MISC
- https://github.com/esphome/esphome/releases/tag/2021.9.2CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.