AIKIDO-2025-10237
aioesphomeapi is vulnerable to Authentication Bypass by Spoofing
20
Low Risk
This Affects:
aioesphomeapiTL;DR
Affected versions of this package are vulnerable to device impersonation due to inadequate identity verification when it only checks the expected device name at a cached IP address without validating the MAC address. This lack of verification allows unauthorized access, as an attacker could spoof the device name and gain control of the IP address (For example, ARP spoofing), tricking the system into trusting a malicious device and allowing man-in-the-middle (MITM) attacks.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
aioesphomeapi is vulnerable to Authentication Bypass by Spoofing in versions 15.1.0 - 29.9.0.
How to fix this
Upgrade the aioesphomeapi library to the patch version.
Get Secure Now
Secure your code, cloud, and runtime environments in one central system. Find and fix vulnerabilities automatically.
No credit card required | Scan results in 32secs.
SOC 2Compliant
ISO 27001Compliant