Tasmota firmware versions up to 16.0.0 contain a CSRF weakness that bypasses Referer header validation in HttpCheckPriviledgedAccess(), allowing an attacker to craft a Referer header that tricks the device into accepting unauthenticated console commands, Wi‑Fi, MQTT, or firmware changes—an instance of input validation weakness (CWE‑352). The vulnerability permits arbitrary console command execution and reconfiguration of device settings without authentication, jeopardizing the confidentiality, integrity, and availability of the device. The flaw is fixed in commit 1cb7ebc that updates the Referer check logic.

Any device running Tasmota firmware version 16.0.0 or earlier, distributed by arendst via the Tasmota project, is susceptible. The issue affects the web console and HTTP interface exposed on the local network.

With a CVSS score of 7.5, the flaw is considered high impact; no EPSS data is available and it is not listed in CISA KEV, yet the attack requires only that an administrator visits a crafted page on the device's network. Because the vulnerability does not require authentication, it is readily exploitable by anyone who can reach the device, making it a significant risk for exposed, unsecured devices.