Espressif Esp32
8 CVEs affecting Espressif Esp32. Latest disclosed: 2026-04-24. Critical: 0, High: 4.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-41429 | High | 8.8 | 2026-04-24 | arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, there is a remotely reach… |
CVE-2021-28139 | High | 8.8 | 2021-09-07 | The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly restrict the Feature Page upon reception of an LMP Feature Response… |
CVE-2021-41104 | High | 7.5 | 2021-09-28 | ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to a… |
CVE-2021-34173 | High | 7.5 | 2021-07-14 | An attacker can cause a Denial of Service and kernel panic in v4.2 and earlier versions of Espressif esp32 via a malformed beacon csa frame. The device require… |
CVE-2025-27840 | Medium | 6.8 | 2025-03-08 | Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory). |
CVE-2021-28136 | Medium | 6.5 | 2021-09-07 | The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets… |
CVE-2020-13595 | Medium | 6.5 | 2020-08-31 | The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.0 through 4.2 (for ESP32 devices) returns the wrong number of completed BLE pac… |
CVE-2020-13594 | Medium | 6.5 | 2020-08-31 | The Bluetooth Low Energy (BLE) controller implementation in Espressif ESP-IDF 4.2 and earlier (for ESP32 devices) does not properly restrict the channel map fi… |