ESPHome Device Builder: Unauthenticated dashboard access via LAN-exposed ingress site

Summary

ESPHome Device Builder Dashboard before 1.0.10 binds its trusted Home Assistant add-on ingress site to 0.0.0.0 without authentication. Because the add-on runs with host networking, any device on the local network can connect directly to this port, bypass the Supervisor and obtain full dashboard access without credentials. An attacker could then execute Python and shell commands during compile and validation, and access configuration and data files, which may compromise the Home Assistant configuration and managed ESPHome devices.

Affected

• ESPHome Device Builder Dashboard versions before 1.0.10
• Home Assistant ESPHome add-on with the Device Builder, running with host networking
• Not affected: standalone Docker dashboard and the password-gated public port 6052

Fixed in

• Version 1.0.10 (ingress site bound to loopback and supervisor gateway only, with peer guard)

Workaround

• Unknown. No vendor workaround published.
• Restrict access to the Home Assistant host's ingress port from other network segments (e.g. guest and IoT VLANs) until updated.

Exploitation

• No reports of active exploitation found.
• EPSS score 1.17 % (percentile 67).
• A public detection-only check (Nuclei template) exists; no public proof-of-concept exploit found.
• Attack requires adjacent network access (CVSS AV:A), no privileges and no user interaction.

Our recommendation

• Update the ESPHome add-on or Device Builder to version 1.0.10 or later in the next maintenance window, sooner on flat networks.
• Check which Home Assistant hosts run the ESPHome add-on with a version before 1.0.10.
• Segment IoT and guest networks from the Home Assistant host until the update is applied.
• Review Home Assistant and ESPHome device configurations for unexpected changes if exposure is suspected.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-vv4j-m4vr-f3g6 github.com
• Fix commit b6387db github.com
• Pull Request #1565 github.com
• Release 1.0.10 github.com
• OSV GHSA-vv4j-m4vr-f3g6 osv.dev
• Nuclei detection template PR github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 09:33.