TASMOTA · CVE-2026-119755 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Tasmota firmware through 16.0.0 checks the Referer header to block cross-site requests, but the check can be fooled by a crafted Referer containing the device's hostname or IP. An attacker who lures an administrator on the same network to a malicious page can run console commands and change Wi-Fi, MQTT, settings, or firmware on devices without a web password.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Devices running Tasmota firmware through 16.0.0 that have no web admin password set are exposed, because the Referer-based CSRF check in HttpCheckPriviledgedAccess() can be bypassed. The attack needs an administrator on the device's network to open a malicious page; devices with a WebPassword set are not affected by this flaw as described. Teams that run Tasmota on home-automation or industrial sensors should check firmware and password settings.
Not affected if patched-firmware, web-password-set
Who cares iot, self-hosted, tasmota
Status 2 in the console; versions through 16.0.0 are in scope.1cb7ebc per the NVD description; no release version stated in the sources.Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.