Threat database

xiaozhi-esp32-server-java versions up to 6.1.0 contain an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid device WebSocket tokens by requesting the /api/device/ota endpoint with any MAC address. This enables attackers to open a victim device's WebSocket channel to read private system prompts, write conversation history, consume credentials, and overwrite device metadata.

A weakness has been identified in joey-zhou xiaozhi-esp32-server-java up to 3.0.0. This impacts the function tryAuthenticateWithCookies of the file AuthenticationInterceptor.java of the component Cookie Handler. Executing manipulation can lead to improper authentication. The attack can be launched remotely. The exploit has been made available to the public and could be exploited. Upgrading to version 4.0.0 will fix this issue. It is recommended to upgrade the affected component.