Vulnerability	Vulnerable Version
C Missing Authentication for Critical Function esphome-device-builder is an ESPHome Device Builder Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the lack of authentication enforcement in the `DashboardSettings.parse_args` process when only legacy environment variables are set. An attacker can gain unauthorized access to the dashboard and perform actions such as managing devices, editing configurations, and flashing firmware by connecting to the dashboard port without credentials. This is only exploitable if the deployment relies solely on the legacy `$USERNAME` and `$PASSWORD` environment variables for authentication, and does not use the updated environment variables, command-line arguments, or Home Assistant add-on ingress. How to fix Missing Authentication for Critical Function? Upgrade `esphome-device-builder` to version 1.0.12 or higher.	[,1.0.12)

Missing Authentication for Critical Function

esphome-device-builder is an ESPHome Device Builder

Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the lack of authentication enforcement in the DashboardSettings.parse_args process when only legacy environment variables are set. An attacker can gain unauthorized access to the dashboard and perform actions such as managing devices, editing configurations, and flashing firmware by connecting to the dashboard port without credentials. This is only exploitable if the deployment relies solely on the legacy $USERNAME and $PASSWORD environment variables for authentication, and does not use the updated environment variables, command-line arguments, or Home Assistant add-on ingress.

How to fix Missing Authentication for Critical Function?

Upgrade esphome-device-builder to version 1.0.12 or higher.

[,1.0.12)

Go back to all versions of this package