Homepage

esphome-device-builder@1.0.7

ESPHome Device Builder

  • latest version

    1.19.0

  • latest non vulnerable version

    1.19.0

  • first published

    5 months ago

  • latest version published

    8 hours ago

  • licenses detected

  • View esphome-device-builder package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the esphome-device-builder package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Binding to an Unrestricted IP Address

    esphome-device-builder is an ESPHome Device Builder

    Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address via the dashboard process. An attacker can gain full control over the application environment, including executing arbitrary code and accessing or modifying sensitive files, by sending unauthenticated requests from the local network to the exposed ingress port. #

    Workaround

    This vulnerability can be mitigated by restricting access to the add-on's ingress port at the network layer, such as implementing firewall rules to allow only the Home Assistant host and supervisor to connect, and ensuring the host resides on a trusted LAN segment.

    How to fix Binding to an Unrestricted IP Address?

    Upgrade esphome-device-builder to version 1.0.10 or higher.

    [,1.0.10)
    • C
    Missing Authentication for Critical Function

    esphome-device-builder is an ESPHome Device Builder

    Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the lack of authentication enforcement in the DashboardSettings.parse_args process when only legacy environment variables are set. An attacker can gain unauthorized access to the dashboard and perform actions such as managing devices, editing configurations, and flashing firmware by connecting to the dashboard port without credentials. This is only exploitable if the deployment relies solely on the legacy $USERNAME and $PASSWORD environment variables for authentication, and does not use the updated environment variables, command-line arguments, or Home Assistant add-on ingress.

    How to fix Missing Authentication for Critical Function?

    Upgrade esphome-device-builder to version 1.0.12 or higher.

    [,1.0.12)
    Go back to all versions of this package