The arduino-esp32 core for ESP32 microcontrollers versions before 3.3.8 contains an improper authentication vulnerability (CWE-287) in its WebServer Digest authentication mechanism. Specifically, the authentication hash is computed using the URI field from the client's Authorization header without verifying that it corresponds to the actual requested URI. This permits an attacker who has a valid digest response for one URI to reuse it to authenticate requests to other protected URIs, effectively bypassing per-resource access control restrictions. This vulnerability has a CVSS 3.1 base score of 7.5 (high severity) and is addressed by updating to version 3.3.8.

An attacker can bypass per-resource access controls by reusing a valid digest authentication response intended for one URI to access other protected URIs. This compromises the intended authentication boundaries and could allow unauthorized access to sensitive resources. The vulnerability does not impact confidentiality beyond authentication bypass, nor does it affect integrity or availability directly.

A fix is available in arduino-esp32 version 3.3.8. Users should upgrade to version 3.3.8 or later to remediate this vulnerability. Since this is a cloud service managed by the vendor, the vendor is responsible for patching the hosted service. Check the vendor advisory for confirmation of patch deployment status.