References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

ESPHome through 2026.7.0-dev discloses plaintext passwords via its web_server component. In WebServer::text_json_() (esphome/components/web_server/web_server.cpp), a text entity configured with mode: password (TEXT_MODE_PASSWORD) has its JSON "state" field correctly masked as "********", but the same serialization path unconditionally writes the raw password into the JSON "value" field via set_json_icon_state_value()/set_json_value(). Because web_server listens on port 80 with no authentication by default, any attacker on the local network can retrieve the plaintext password (e.g. WiFi credentials, API tokens) via GET /text/<entity_id> or the /events EventSource stream.

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-522

https://github.com/esphome/esphome

https://github.com/esphome/esphome/blob/dev/esphome/components/web_server/web_server.cpp

[{"vendor":"esphome","product":"esphome","defaultStatus":"unaffected","programFiles":["esphome/components/web_server/web_server.cpp"],"versions":[{"version":"0","lessThanOrEqual":"2026.7.0","versionType":"semver","status":"affected"}]}]