ESPHome Device Builder exposes a dashboard that, when running as the Home Assistant add‑on, binds to all network interfaces and skips authentication. An attacker on the same LAN can reach the ingress port without credentials, triggering the dashboard’s ability to execute arbitrary Python via external_components, run shell commands during compile and validation processes, and read or modify configuration files. This grants full control over the Home Assistant installation and any connected ESPHome devices.

Systems affected are installations of ESPHome Device Builder earlier than version 1.0.10 that use the Home Assistant add‑on with host networking enabled. The vulnerability is specific to the ingress site bound to 0.0.0.0; the standalone Docker dashboard and the password‑protected public port 6052 are not impacted.

The CVSS score of 8.8 indicates high severity. Exploitation requires only local network presence; no credentials or additional software are needed. Because the ingress site accepts unauthenticated traffic, any device on the LAN can access it. The vulnerability is not yet listed in CISA KEV, and EPSS data is unavailable, but the combination of local reachability and the ability to execute arbitrary code makes it a significant risk for any network that allows devices to communicate with the Home Assistant host.