Tasmota vulnerabilities

2 known vulnerabilities in Tasmota from Arendst. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Tasmota: Buffer Access with Incorrect Length Value

  CVE-2026-119756Nov 9, 2026Arendst

  Tasmota through 16.0.0, fixed in commit e97e1e4, contains a heap out-of-bounds write vulnerability in SendReceiveDeviceGroupMessage() that allows unauthenticated attackers on the local network to corrupt heap memory by sending crafted Device Groups messages ov

• 7.5 High severity

  Tasmota: Cross-Site Request Forgery

  CVE-2026-119755Nov 9, 2026Arendst

  Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hos