{"id":"CVE-2026-119755","kind":"vulnerability","aliases":["CVE-2026-119755"],"related":[],"title":"Tasmota: CSRF bypass lets a lured admin reconfigure IoT devices","description":"Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword.","summary":"Tasmota firmware through 16.0.0 checks the Referer header to block cross-site requests, but the check can be fooled by a crafted Referer containing the device's hostname or IP. An attacker who lures an administrator on the same network to a malicious page can run console commands and change Wi-Fi, MQTT, settings, or firmware on devices without a web password.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Tasmota","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["infrastructure","iot","self-hosted","tasmota"],"not_affected_if":["patched-firmware","web-password-set"],"how_to_check":"- Check the firmware version in the device's web console or with `Status 2` in the console; versions through `16.0.0` are in scope.\n- Check whether a web password is set: Configuration > Web Admin Password. Devices with no WebPassword are the exposed case.","fix":"- Fixed in commit `1cb7ebc` per the NVD description; no release version stated in the sources.","status":"open","published_at":"2026-11-09T18:17:22+00:00","first_seen_at":"2026-11-09T18:27:55+00:00","triaged_at":"2026-11-09T18:29:17+00:00","updated_at":"2026-11-09T18:29:17+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-09T18:29:17Z","model":"claude-haiku-5-5","output":{"fix":"- Fixed in commit `1cb7ebc` per the NVD description; no release version stated in the sources.","reach":"network","title":"Tasmota: CSRF bypass lets a lured admin reconfigure IoT devices","impact":"high","summary":"Tasmota firmware through 16.0.0 checks the Referer header to block cross-site requests, but the check can be fooled by a crafted Referer containing the device's hostname or IP. An attacker who lures an administrator on the same network to a malicious page can run console commands and change Wi-Fi, MQTT, settings, or firmware on devices without a web password.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["tasmota","iot","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reconfigures device, changes firmware, and runs console commands","analyst_note":"Confirm the fixed release version for commit 1cb7ebc at https://nvd.nist.gov/vuln/detail/CVE-2026-119755 and the vulncheck advisory.","how_to_check":"- Check the firmware version in the device's web console or with `Status 2` in the console; versions through `16.0.0` are in scope.\n- Check whether a web password is set: Configuration > Web Admin Password. Devices with no WebPassword are the exposed case.","plain_action":"","product_name":"Tasmota","needs_analyst":true,"not_affected_if":["web-password-set","patched-firmware"],"who_is_affected":"Devices running Tasmota firmware through 16.0.0 that have no web admin password set are exposed, because the Referer-based CSRF check in HttpCheckPriviledgedAccess() can be bypassed. The attack needs an administrator on the device's network to open a malicious page; devices with a WebPassword set are not affected by this flaw as described. Teams that run Tasmota on home-automation or industrial sensors should check firmware and password settings.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000833,"input_tokens":4694,"output_tokens":727,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119755':13A,16A '-2026':12A,15A '/.':135C '16.0.0':27B,90C '1cb7ebc':94C 'admin':7A 'administr':60B,140C 'allow':104C 'appear':127C 'arbitrari':152C 'attack':56B,106C,136C 'base':111C 'block':33B 'bypass':3A,108C 'chang':74B 'check':28B,40B 'command':72B,154C 'commit':93C 'consol':71B,153C 'contain':48B,95C 'craft':46B,117C 'cross':35B,98C 'cross-sit':34B,97C 'csrf':2A,112C 'cve':11A,14A 'devic':10A,50B,83B,123C,143C,165C 'evil.com':134C 'evil.com/.':133C 'fi':77B,159C 'firmwar':25B,81B,163C 'fix':91C 'fool':43B 'forgeri':101C 'header':31B,120C 'host':22B 'hostnam':52B,124C 'httpcheckpriviledgedaccess':115C 'immedi':131C 'infrastructur':18B 'iot':9A,19B 'ip':54B,126C 'issu':151C 'lack':166C 'let':4A 'lure':6A,58B,138C 'malici':67B,148C 'mqtt':78B,160C 'network':64B,145C 'page':68B,149C 'password':87B 'protect':113C 'reconfigur':8A,156C 'refer':30B,47B,110C,119C 'referer-bas':109C 'request':37B,100C 'run':70B 'self':21B 'self-host':20B 'set':79B,161C 'site':36B,99C 'substr':130C 'tasmota':1A,17A,23B,24B,88C 'unauthent':105C 'vulner':102C 'web':86B 'webpassword':168C 'wi':76B,158C 'wi-fi':75B,157C 'without':84B","nicknames":[],"mitigations":[],"who_affected":"Devices running Tasmota firmware through 16.0.0 that have no web admin password set are exposed, because the Referer-based CSRF check in HttpCheckPriviledgedAccess() can be bypassed. The attack needs an administrator on the device's network to open a malicious page; devices with a WebPassword set are not affected by this flaw as described. Teams that run Tasmota on home-automation or industrial sensors should check firmware and password settings.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["tasmota"],"ptokens":["tasmota"],"labels":["high","infrastructure","iot","selfhosted","tasmota","vendor"],"campaign_type":null,"search_a":"'-119755':13A,16A '-2026':12A,15A 'admin':7A 'bypass':3A 'csrf':2A 'cve':11A,14A 'devic':10A 'iot':9A 'let':4A 'lure':6A 'reconfigur':8A 'tasmota':1A,17A","search_b":"'16.0.0':27B 'administr':60B 'attack':56B 'block':33B 'chang':74B 'check':28B,40B 'command':72B 'consol':71B 'contain':48B 'craft':46B 'cross':35B 'cross-sit':34B 'devic':50B,83B 'fi':77B 'firmwar':25B,81B 'fool':43B 'header':31B 'host':22B 'hostnam':52B 'infrastructur':18B 'iot':19B 'ip':54B 'lure':58B 'malici':67B 'mqtt':78B 'network':64B 'page':68B 'password':87B 'refer':30B,47B 'request':37B 'run':70B 'self':21B 'self-host':20B 'set':79B 'site':36B 'tasmota':23B,24B 'web':86B 'wi':76B 'wi-fi':75B 'without':84B","search_c":"'/.':135C '16.0.0':90C '1cb7ebc':94C 'administr':140C 'allow':104C 'appear':127C 'arbitrari':152C 'attack':106C,136C 'base':111C 'bypass':108C 'command':154C 'commit':93C 'consol':153C 'contain':95C 'craft':117C 'cross':98C 'cross-sit':97C 'csrf':112C 'devic':123C,143C,165C 'evil.com':134C 'evil.com/.':133C 'fi':159C 'firmwar':163C 'fix':91C 'forgeri':101C 'header':120C 'hostnam':124C 'httpcheckpriviledgedaccess':115C 'immedi':131C 'ip':126C 'issu':151C 'lack':166C 'lure':138C 'malici':148C 'mqtt':160C 'network':145C 'page':149C 'protect':113C 'reconfigur':156C 'refer':110C,119C 'referer-bas':109C 'request':100C 'set':161C 'site':99C 'substr':130C 'tasmota':88C 'unauthent':105C 'vulner':102C 'webpassword':168C 'wi':158C 'wi-fi':157C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T18:17:22+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119755","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119755","severity":null,"published_at":"2026-11-09T18:17:22+00:00","modified_at":"2026-11-09T18:17:22+00:00","first_seen_at":"2026-11-09T18:27:55+00:00","fetched_at":"2026-11-09T18:27:55+00:00","note":null}],"documents":[{"id":108783,"url":"https://github.com/arendst/Tasmota/commit/1cb7ebcafb0b79f1836d0e9948275f78abc17d7b","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":108784,"url":"https://www.vulncheck.com/advisories/tasmota-csrf-via-referer-header-validation-bypass","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}