CVE-2026-42855

arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:espressif:arduino-esp32:*:-:*:*:*:*:*:*

History

26 Oct 2026, 14:10

Type	Values Removed	Values Added
Summary		(es) arduino-esp32 es un núcleo de Arduino para los microcontroladores ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 y ESP32-H2. Antes de 3.3.8, la implementación de autenticación Digest de WebServer en arduino-esp32 calcula el hash de autenticación utilizando el campo URI del encabezado de autorización del cliente, sin verificar que coincida con la URI real solicitada. Esto permite a un atacante que posee cualquier respuesta digest válida (calculada para URI-A) autenticar solicitudes a una URI protegida completamente diferente (URI-B), eludiendo el control de acceso por recurso. Esta vulnerabilidad se corrigió en 3.3.8.

Information

Published : 2026-05-12 22:16

Updated : 2026-10-26 14:10

NVD link : CVE-2026-42855

Mitre link : CVE-2026-42855

CVE.ORG link : CVE-2026-42855

JSON object : View

Products Affected

espressif

arduino-esp32

CWE

CWE-287

Improper Authentication

NVD-CWE-noinfo

{"id": "CVE-2026-42855", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42855", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T15:32:50.254940Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "espressif", "product": "arduino-esp32", "versions": [{"status": "affected", "version": "< 3.3.8"}]}]}], "published": "2026-05-12T22:16:35.067", "references": [{"url": "https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-287"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8."}, {"lang": "es", "value": "arduino-esp32 es un n\u00facleo de Arduino para los microcontroladores ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 y ESP32-H2. Antes de 3.3.8, la implementaci\u00f3n de autenticaci\u00f3n Digest de WebServer en arduino-esp32 calcula el hash de autenticaci\u00f3n utilizando el campo URI del encabezado de autorizaci\u00f3n del cliente, sin verificar que coincida con la URI real solicitada. Esto permite a un atacante que posee cualquier respuesta digest v\u00e1lida (calculada para URI-A) autenticar solicitudes a una URI protegida completamente diferente (URI-B), eludiendo el control de acceso por recurso. Esta vulnerabilidad se corrigi\u00f3 en 3.3.8."}], "lastModified": "2026-10-26T14:10:00.130", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:espressif:arduino-esp32:*:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "308785AC-A885-47B5-9131-64AE662B6525", "versionEndExcluding": "3.3.8"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}