CVE-2026-42855

{
  "id": "CVE-2026-42855",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-12T22:16:35.067",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Prior to 3.3.8, the WebServer Digest authentication implementation in arduino-esp32 computes the authentication hash using the URI field from the client's Authorization header, without verifying that it matches the actual requested URI. This allows an attacker who possesses any valid digest response (computed for URI-A) to authenticate requests to a completely different protected URI (URI-B), bypassing per-resource access control. This vulnerability is fixed in 3.3.8."
    },
    {
      "lang": "es",
      "value": "arduino-esp32 es un núcleo de Arduino para los microcontroladores ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 y ESP32-H2. Antes de 3.3.8, la implementación de autenticación Digest de WebServer en arduino-esp32 calcula el hash de autenticación utilizando el campo URI del encabezado de autorización del cliente, sin verificar que coincida con la URI real solicitada. Esto permite a un atacante que posee cualquier respuesta digest válida (calculada para URI-A) autenticar solicitudes a una URI protegida completamente diferente (URI-B), eludiendo el control de acceso por recurso. Esta vulnerabilidad se corrigió en 3.3.8."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "espressif",
          "product": "arduino-esp32",
          "versions": [
            {
              "version": "< 3.3.8",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-13T15:32:50.254940Z",
          "id": "CVE-2026-42855",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    },
    {
      "source": "[email protected]",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:espressif:arduino-esp32:*:-:*:*:*:*:*:*",
              "versionEndExcluding": "3.3.8",
              "matchCriteriaId": "308785AC-A885-47B5-9131-64AE662B6525"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/espressif/arduino-esp32/security/advisories/GHSA-28hv-fwm3-rpcq",
      "source": "[email protected]",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ]
    }
  ]
}