Espressif ESP32

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reachable memory corruption issue in the NBNS packet handling path. When NetBIOS is enabled by calling NBNS.begin(...), the device listens on UDP port 137 and processes untrusted NBNS requests from the local network. The request parser trusts the attacker-controlled name_len field without enforcing a bound consistent with the fixed-size destination buffers used later in the flow. This vulnerability is fixed in 3.3.8.

Published: 2026-04-24T19:19:49.594Z
Updated: 2026-04-27T13:34:49.485Z

Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).

Published: 2025-03-08T00:00:00.000Z
Updated: 2025-05-12T15:33:14.134Z

ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.

Published: 2021-09-28T15:15:11.000Z
Updated: 2024-08-04T02:59:31.350Z

An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame. The device requires a reboot to recover.

Published: 2021-07-14T18:32:54.000Z
Updated: 2024-08-04T00:05:52.463Z

The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response Extended packet, allowing attackers in radio range to trigger arbitrary code execution in ESP32 via a crafted Extended Features bitfield payload.

Published: 2021-09-07T06:27:53.000Z
Updated: 2024-08-03T21:33:17.547Z