Executive brief
Tasmota is a popular open-source firmware used to control smart home devices based on ESP32 and ESP8266 chips, such as smart plugs and light switches. A security flaw in how the firmware handles image downloads allows a malicious server to take control of the device. If an attacker can trick the device into connecting to a rogue server, they could potentially steal data, disrupt home automation, or use the device as a foothold to attack other systems on the local network.
Technical details
A stack-based buffer overflow exists in the fetch_jpg() function within xdrv_10_scripter.ino. The vulnerability is caused by the use of the unsafe strcpy() function when copying the MJPEG boundary string from an HTTP Content-Type header into a fixed-size 40-byte buffer (jpg_task.boundary). An attacker-controlled HTTP server can provide a boundary string exceeding 39 characters to overflow the buffer. This allows for the corruption of adjacent heap memory, specifically overwriting vtable pointers for WiFiClient or HTTPClient objects, leading to remote code execution (RCE) on the ESP32 platform. The issue is addressed in Tasmota version 15.3.0.4 and later.
Affected products
- arendst Tasmota <= 15.3.0.3
Timeline
- 2026-03-29: disclosed: Vulnerability discovered and reported to MITRE
- 2026-05-27: advisory: CVE published by NVD
- 2026-05-01: patched: Patch released in v15.3.0.4 (approximate date based on advisory)