Skip to content
Noroxi

espressif records

46 published records for vendor espressif.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
3
With a fix record
21.7%
Median publish → KEV
No record has entered KEV

Records by year

  1. 19
  2. 20
  3. 21
  4. 22
  5. 23
  6. 24
  7. 25
  8. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

46 records
  • CVE-2026-42854
    39Monitor

    arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE

    CriticalCVSS 9.8No exploitEPSS 0%

    espressif · arduino-esp32May 12, 2026

  • CVE-2021-28139
    35Monitor

    The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an L

    HighCVSS 8.8No exploitEPSS 1%

    espressif · esp-idfSep 7, 2021

  • CVE-2024-53406
    35Monitor

    Espressif Esp idf v5.3.0 is vulnerable to Insecure Permissions resulting in Authentication bypass.

    HighCVSS 8.8No exploitEPSS 0%

    espressif · esp-idfMar 13, 2025

  • CVE-2022-24893
    35Monitor

    Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption

    HighCVSS 8.8No exploitEPSS 0%

    espressif · esp-idfJun 25, 2022

  • CVE-2026-41429
    35Monitor

    Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption

    HighCVSS 8.8No exploitEPSS 0%

    espressif · arduino-esp32Apr 24, 2026

  • CVE-2026-45328
    35Monitor

    ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers

    HighCVSS 8.8No exploitEPSS 0%

    espressif · esp-idfJun 9, 2026

  • CVE-2024-33453
    32Monitor

    Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.

    HighCVSS 8.1Proof of conceptEPSS 0%

    espressif · esp-idfOct 17, 2024

  • CVE-2019-12587
    32Monitor

    The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 allows the installation of a

    HighCVSS 8.1No exploitEPSS 0%

    espressif · esp-idfSep 4, 2019

  • CVE-2026-25532
    32Monitor

    ESF-IDF is Vulnerable to WPS Enrollee Fragment Integer Underflow

    HighCVSS 8.0No exploitEPSS 0%

    espressif · esp-idfFeb 4, 2026

  • CVE-2021-34173
    30Monitor

    An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame.

    HighCVSS 7.5No exploitEPSS 1%

    espressif · esp32 firmwareJul 14, 2021

  • CVE-2020-16146
    30Monitor

    Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.7, 3.2.x through 3.2.3, 3.3.x through 3.3.2, and 4.0.x through 4.0.1 has a Buf

    HighCVSS 7.5No exploitEPSS 1%

    espressif · esp-idfJan 11, 2021

  • CVE-2021-41104
    30Monitor

    web_server allows OTA update without checking user defined basic auth username & password

    HighCVSS 7.5No exploitEPSS 1%

    esphome · esphome firmwareSep 28, 2021

  • CVE-2024-51428
    30Monitor

    An issue in Espressif Esp idf v5.3.0 allows attackers to cause a Denial of Service (DoS) via a crafted data channel packet.

    HighCVSS 7.5Proof of conceptEPSS 0%

    espressif · esp-idfNov 7, 2024

  • CVE-2023-46894
    30Monitor

    An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.

    HighCVSS 7.5No exploitEPSS 0%

    espressif · esptoolNov 9, 2023

  • CVE-2026-45541
    30Monitor

    ESF-IDF: Remote Null Pointer Dereference in WebSocket Server

    HighCVSS 7.5No exploitEPSS 0%

    espressif · esp-idfJun 9, 2026

  • CVE-2026-42855
    30Monitor

    arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack

    HighCVSS 7.5No exploitEPSS 0%

    espressif · arduino-esp32May 12, 2026

  • CVE-2025-52471
    28Monitor

    ESP-NOW Integer Underflow Vulnerability Advisory

    HighCVSS 7.2No exploitEPSS 0%

    espressif · esp-idfJun 24, 2025

  • CVE-2026-45542
    28Monitor

    ESF-IDF: Heap buffer overflow in protocomm Security2 over Bluetooth

    HighCVSS 7.1No exploitEPSS 0%

    espressif · esp-idfJun 9, 2026

  • CVE-2025-27840
    27Monitor

    Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).

    MediumCVSS 6.8Proof of conceptEPSS 1%

    espressif · esp32 firmwareMar 8, 2025

  • CVE-2020-12638
    27Monitor

    An encryption-bypass issue was discovered on Espressif ESP-IDF devices through 4.2, ESP8266_NONOS_SDK devices through 3.0.3, and ESP8266_RTO

    MediumCVSS 6.8No exploitEPSS 0%

    espressif · esp-idfJul 23, 2020

  • CVE-2019-15894
    27Monitor

    An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1.

    MediumCVSS 6.8No exploitEPSS 0%

    espressif · esp-idfOct 7, 2019

  • CVE-2025-68622
    27Monitor

    Espressif ESP-IDF USB Host UVC Class Driver has a stack buffer overflow in UVC descriptor printing

    MediumCVSS 6.8No exploitEPSS 0%

    espressif · usb host uvc class driverJan 12, 2026

  • CVE-2023-35818
    27Monitor

    An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices.

    MediumCVSS 6.8No exploitEPSS 0%

    espressif · esp32-d0wd-v3 firmwareJul 17, 2023

  • CVE-2025-68656
    27Monitor

    Espressif ESP-IDF USB Host HID (Human Interface Device) Driver Descriptor Use-After-Free Vulnerability

    MediumCVSS 6.8No exploitEPSS 0%

    espressif · usb host hid driverJan 12, 2026

  • CVE-2019-12586
    26Monitor

    The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266_NONOS_SDK 2.2.0 through 3.1.0 processes EAP Success message

    MediumCVSS 6.5Proof of conceptEPSS 1%

    espressif · arduino-esp32Sep 4, 2019