High severity · published Jul 7, 2025
CVE-2025-53540
CSRF Vulnerability in Firmware Update Endpoints Allows Remote Code Execution
8.7
CVSS
0.3%
EPSS
No
On KEV
Description
arduino-esp32 is an Arduino core for the ESP32, ESP32-S2, ESP32-S3, ESP32-C3, ESP32-C6 and ESP32-H2 microcontrollers. Several OTA update examples and the HTTPUpdateServer implementation are vulnerable to Cross-Site Request Forgery (CSRF). The update endpoints accept POST requests for firmware uploads without CSRF protection. This allows an attacker to upload and execute arbitrary firmware, resulting in remote code execution (RCE). This vulnerability is fixed in 3.2.1.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AR
arduino-esp32 · espressif
< 3.2.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-53540
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-53540
github.com
https://github.com/espressif/arduino-esp32/commit/f4fdecc60c465384e465a4b1d2bd1eac8f67912e
github.com
https://github.com/espressif/arduino-esp32/security/advisories/GHSA-9vfw-wx65-c872
More from arduino-esp32
9.9
CVE-2024-45798
Multiple Poisoned Pipeline Execution (PPE) vulnerabilities
9.8
CVE-2026-42854
arduino-esp32: Stack buffer overflow in WebServer multipart boundary parsing leads to remote crash potential RCE
8.9
CVE-2025-53007
arduino-esp32 vulnerable to CRLF injection in WebServer.cpp
8.8
CVE-2026-41429
Improper validation of NBNS name_len in arduino-esp32 NetBIOS leads to memory corruption
7.5
CVE-2026-42855
arduino-esp32: Digest authentication URI mismatch bypass in WebServer allows cross-resource replay attack