Executive brief
ESPHome Device Builder is an IoT device configuration and firmware management tool that includes a web-based dashboard for managing smart home devices. When operators upgrade from older versions that used USERNAME/PASSWORD environment variables to newer versions using ESPHOME_USERNAME/ESPHOME_PASSWORD, the dashboard silently loses authentication and becomes accessible to anyone with network access. An attacker can exploit this to modify device configurations and flash unauthorized firmware, potentially compromising all connected IoT devices and the systems they control.
Technical details
The vulnerability stems from a backward compatibility regression in the DashboardSettings.parse_args function. Versions prior to 1.0.12 accepted legacy USERNAME and PASSWORD environment variables as a fallback; the env var rename in version 1.0.12 (introduced without changelog documentation) dropped this fallback without replacement. Deployments that had set only the bare environment variable names for authentication now resolve to no credentials; the REST auth middleware and WebSocket login gate are both disabled. The startup process logs a "WITHOUT AUTHENTICATION" banner, but in detached Docker containers (docker run -d), this warning is never surfaced to operators, making the exposure silent in practice. An unauthenticated network client can reach the dashboard port and directly manage devices, edit configurations, and flash firmware—operations that ESPHome's threat model documents as allowing arbitrary code execution at compile time and read/write access to config and data directories. The vulnerability only affects deployments using the bare USERNAME/PASSWORD variables; those using command-line flags or the new ESPHOME_* variables are unaffected. Fixed in version 1.0.12 with a deprecated fallback that maintains backward compatibility while warning operators to migrate.
Affected products
- ESPHome esphome-device-builder < 1.0.12
- ESPHome esphome (container) < 2026.6.2
Timeline
- 2026-09-14: disclosed
- 2026-06-20: patched: Fix released in esphome-device-builder 1.0.12
- 2026-09-14: other: esphome container 2026.6.2 delivery of fix