https://vulnerability.circl.lu/sightings/feed 2026-09-15T21:13:23.099437+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/e8809fdd-933c-49c2-9812-79483c10357b/export 2026-09-15T21:13:23.127703+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "e8809fdd-933c-49c2-9812-79483c10357b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59178", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5fspgwj62ll5j", "content": "CVE-2026-59178 - ESPHome Device Builder: Renamed auth env vars silently disable dashboard authentication on upgrade\nCVE ID : CVE-2026-59178\n \n Published : Sept. 14, 2026, 7:17 p.m. | 42\u00a0minutes ago\n \n Description : ESPHome Device Builder Dashboard is a dashboard for the ESPHom...", "creation_timestamp": "2026-09-14T20:30:51.693794Z"} 2026-09-14T20:30:51.693794+00:00 https://vulnerability.circl.lu/sighting/9966d186-c6bc-42f2-b47c-3c76eef3643c/export 2026-09-15T21:13:23.130042+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "9966d186-c6bc-42f2-b47c-3c76eef3643c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59178", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvivzrrxfa2p", "content": "\ud83d\udea8 CVE-2026-59178 \u2014 CVSS 9.8 CRITICAL\n\nESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-59178\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-14T20:08:31.692377Z"} 2026-09-14T20:08:31.692377+00:00 https://vulnerability.circl.lu/sighting/011571f8-61f6-44c0-85e2-e7824a904e6a/export 2026-09-15T21:13:23.130156+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "011571f8-61f6-44c0-85e2-e7824a904e6a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59178", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvivlsynqu2k", "content": "\ud83d\udd34 CVE-2026-59178 - Critical (9.8)\n\nESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior t...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-59178/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T20:00:44.073790Z"} 2026-09-14T20:00:44.073790+00:00 https://vulnerability.circl.lu/sighting/411ef700-0864-4e70-8098-b3b8a6cc0db5/export 2026-09-15T21:13:23.130248+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "411ef700-0864-4e70-8098-b3b8a6cc0db5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59178", "type": "seen", "source": "https://gist.github.com/alon710/3693f8803a657bff4ffb362747901533", "content": "# CVE-2026-59178: CVE-2026-59178: Authentication Bypass in ESPHome Device Builder Dashboard\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-09-14\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59178\n\n## Summary\nAn authentication bypass vulnerability in ESPHome Device Builder Dashboard allows unauthenticated remote attackers to gain administrative access. The flaw is caused by a backward compatibility break during an environment variable rename that silently disables dashboard authentication upon upgrade.\n\n## TL;DR\nESPHome Device Builder Dashboard silently disables authentication upon upgrading if operators rely on legacy USERNAME and PASSWORD environment variables, granting full unauthenticated administrative access to remote network attackers.\n\n## Technical Details\n\n- **CWE ID**: CWE-306 (Missing Authentication for Critical Function)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 9.8\n- **Exploit Status**: None\n- **CISA KEV Status**: Not Listed\n- **Impact**: Unauthenticated Remote Code Execution and Firmware Manipulation\n\n## Affected Systems\n\n- ESPHome Device Builder Dashboard standalone container installations\n- **esphome-device-builder**: < 1.0.12 (Fixed in: `1.0.12`)\n- **ghcr.io/esphome/esphome**: < 2026.6.2 (Fixed in: `2026.6.2`)\n\n## Mitigation\n\n- Upgrade to esphome-device-builder >= 1.0.12\n- Rename environment variables to ESPHOME_USERNAME and ESPHOME_PASSWORD\n- Implement firewall or VPN access controls\n\n**Remediation Steps:**\n1. Identify any running instances of the ESPHome Device Builder Dashboard using docker ps.\n2. Inspect the container environment variables to verify if legacy USERNAME or PASSWORD is in use.\n3. Stop the container and update the configuration to use ESPHOME_USERNAME and ESPHOME_PASSWORD.\n4. Pull the latest image tag (2026.6.2 or higher) and restart the service.\n\n## References\n\n- [Official Security Advisory](https://github.com/esphome/device-builder/security/advisories/GHSA-rrxg-g2pf-6hh4)\n- [Fix Pull Request (PR #1625)](https://github.com/esphome/device-builder/pull/1625)\n- [Official Fix Commit](https://github.com/esphome/device-builder/commit/9e294f729c3eb7334bb57b9fc49b75b728052f52)\n- [Release Page (Version 1.0.12)](https://github.com/esphome/device-builder/releases/tag/1.0.12)\n- [ESPHome Security Best Practices Documentation](https://esphome.io/guides/security_best_practices/)\n- [ESPHome 2026.6.0 Changelog](https://esphome.io/changelog/2026.6.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59178) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-14T19:32:08.534025Z"} 2026-09-14T19:32:08.534025+00:00 https://vulnerability.circl.lu/sighting/de12a459-791a-4dde-bbaf-9212011ee78c/export 2026-09-15T21:13:23.130347+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "de12a459-791a-4dde-bbaf-9212011ee78c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59178", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvirnn6qjc2j", "content": "CVE-2026-59178 - device-builder\nWhen esphome/device-builder is updated, it stops reading the old USERNAME and PASSWORD environment variables and only looks for ESPHOME_USERNAME and\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#devicebuilder #esphome #pip #CVE #infosec", "creation_timestamp": "2026-09-14T18:50:08.978321Z"} 2026-09-14T18:50:08.978321+00:00