CVE-2021-41104

ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.

• CWE-306
• CWE-306

• https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1ePatch, Third Party Advisory
• https://github.com/esphome/esphome/releases/tag/2021.9.2Release Notes, Third Party Advisory
• https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfmPatch, Third Party Advisory
• https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1ePatch, Third Party Advisory
• https://github.com/esphome/esphome/releases/tag/2021.9.2Release Notes, Third Party Advisory
• https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfmPatch, Third Party Advisory

Published

Sep 28, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41098Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader p…7.5
• CVE-2021-41099Redis is an open source, in-memory database that persists on…7.5
• CVE-2021-4110mruby is vulnerable to NULL Pointer Dereference7.5
• CVE-2021-41100Wire-server is the backing server for the open source wire s…9.8
• CVE-2021-41101wire-server is an open-source back end for Wire, a secure co…5.7
• CVE-2021-41103containerd is an open source container runtime with an empha…7.8
• CVE-2021-41105FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2021-41106JWT is a library to work with JSON Web Token and JSON Web Si…3.3
• CVE-2021-41109Parse Server is an open source backend that can be deployed …7.5
• CVE-2021-4111yetiforcecrm is vulnerable to Business Logic Errors4.3
• CVE-2021-41110cwlviewer is a web application to view and share Common Work…9.8
• CVE-2021-41111Rundeck is an open source automation service with a web cons…5.4