Veille CVE

Recherche « xinnan-tech xiaozhi-esp32-server »

1 CVE

Critique 0 Élevée 0 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « xinnan-tech xiaozhi-esp32-server » ✕
  1. CVE-2026-116017 4.3 Moyenne

    xinnan-tech xiaozhi-esp32-server

    Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler that allows authenticated users to read other users' device address books. Attackers with a normal or self-registered account can request /device/address-book/{macAddress} with another user's device MAC to obtain contact MACs, aliases, call permissions, and owner user IDs.