CVE-2025-66409: esp-idf through 5.1.6 (inclusive), from 5.2 (inclusive), through 5.2.6 (inclusive), from 5.3 (inclusive), through…

Affected technology

esp-idf · through 5.1.6 (inclusive)
espressif

esp-idf · from 5.2 (inclusive), through 5.2.6 (inclusive)
espressif

esp-idf · from 5.3 (inclusive), through 5.3.4 (inclusive)
espressif

esp-idf · from 5.4 (inclusive), through 5.4.3 (inclusive)
espressif

esp-idf · from 5.5 (inclusive), through 5.5.1 (inclusive)
espressif

esp-idf · >= 5.5-beta1, <= 5.5.1, >= 5.4-beta1, <= 5.4.3, >= 5.3-beta1, <= 5.3.4, >= 5.2-beta1, <= 5.2.6, <= 5.1.6
espressif

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Vendor/CNA’s CVSS 4.0 assessment (base score 2.7/10) rates confidentiality and availability impact as low; integrity impact as none. The description does not specify what an attacker can achieve beyond these rated impacts.