Executive brief
Tasmota is a popular open-source firmware used to control smart home devices like switches, lights, and sensors. A security flaw in how the firmware handles image downloads (MJPEG streams) allows a remote attacker to take complete control of the device. This could lead to the theft of Wi-Fi credentials, unauthorized access to the home network, or the device being used in a botnet.
Technical details
The vulnerability exists within the fetch_jpg() function in the scripter driver (xdrv_10_scripter.ino). It consists of two compounding memory corruption issues: a strcpy() overflow into a fixed 40-byte boundary buffer (Phase 1) and a uint16_t integer wraparound on the Content-Length header (Phase 2). By hosting a malicious MJPEG server or performing a Man-in-the-Middle (MitM) attack, an attacker can send a crafted HTTP response that corrupts heap memory, including WiFiClient and HTTPClient vtable pointers. This leads to arbitrary code execution or a persistent denial-of-service (crash loop) on ESP32-based devices. The vulnerability is addressed in Tasmota version 15.3.0.4 and later.
Affected products
- arendst Tasmota <= 15.3.0.3
Timeline
- 2026-03-29: disclosed: Vulnerabilities discovered and reported to MITRE
- 2026-05-27: advisory: CVE published by NVD/MITRE
- 2026-05-01: patched: Patch released in Tasmota v15.3.0.4+