CVE-2026-119756 · Infrastructure
NO FIX YET · SEE WHAT TO DO
Tasmota firmware through 16.0.0 has a heap out-of-bounds write in its Device Groups handling, reachable by sending crafted UDP messages on port 4447. An unauthenticated attacker on the local network can crash the device and, on ESP8266 and ESP32 boards without ASLR or heap cookies, possibly run native code.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Devices running Tasmota up to and including 16.0.0 on ESP8266 or ESP32 boards. Devices exposed to the local network are the main concern, since the attack is sent over UDP port 4447 from the same network. Devices on an isolated network with Device Groups disabled are less exposed; the sources do not say whether disabling Device Groups fully removes the listener.
Not affected if device-groups-disabled, isolated-network, newer-build
Who cares esp32, esp8266, iot, self-hosted, tasmota
Status 2 command, and compare it with the fixed commit e97e1e4.DevGroupName or Device Groups settings in the device configuration.4447 is reachable from networks other than the device's own segment.e97e1e4 (the vendor's fixed version number is not given in the sources).Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages over UDP port 4447 that cause the log_remaining counter to go negative and writes to exceed the fixed 512-byte buffer. Attackers can exploit this flaw to crash the device or potentially achieve native code execution on ESP8266 and ESP32 platforms that lack ASLR and heap cookies.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.