Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-42855 Digest Authentication Bypass in Arduino-ESP32 WebServer Before 3.3.8 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42855
Post summary
CVE‑2026‑42855 discloses a Digest authentication bypass in Arduino‑ESP32 WebServer versions prior to 3.3.8.
CVE-2026-42855 arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authenticat… https://www.cve.org/CVERecord?id=CVE-2026-42855
Post summary
The CVE‑2026‑42855 vulnerability affects Arduino‑ESP32 core versions before 3.3.8, involving faulty WebServer Digest authentication, with a patch implied in the newer release but no exploit evidence or PoC provided.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | espressif | arduino-esp32 | - | - | - |