Executive brief
A vulnerability in the XiaoZhi ESP32 chatbot firmware causes private message responses to be broadcast to all connected users on the local network. This means that if multiple people are connected to the device's control interface, one user can see the data and command results intended for another. This could lead to the exposure of sensitive device information or sensor data to unauthorized parties on the same network.
Technical details
An improper synchronization vulnerability (CWE-662) exists in the MCP Response Handler of the xiaozhi-esp32 firmware. The `ParseMessage` function in `main/mcp_server.cc` and the WebSocket control server in the Otto Robot component fail to maintain source connection context for JSON-RPC requests. Consequently, the `BroadcastMessage` function sends MCP responses to every connected WebSocket client rather than routing them specifically to the originating client. An attacker on the local network with low privileges can connect to the WebSocket endpoint and intercept tool results, sensor data, or device state intended for other users. A fix has been proposed in pull request #2021 but is awaiting formal integration into a release.
Affected products
- 78 xiaozhi-esp32 up to 2.2.6
Timeline
- 2026-05-27: disclosed: Issue reported on GitHub repository
- 2026-05-27: other: Pull request to fix the issue submitted
- 2026-06-28: advisory: CVE published and added to NVD