November 13, 2026

CVE Watchtower

CVE-2026-119755arendst Tasmota Cross-Site Request Forgery (CSRF)

NVD

Vulnerability Summary

Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows unauthenticated attackers to bypass Referer-based CSRF protection in HttpCheckPriviledgedAccess() by crafting a Referer header where the device hostname or IP appears as a substring immediately after http://.evil.com/. Attackers can lure an administrator on the device's network to a malicious page to issue arbitrary console commands and reconfigure Wi-Fi, MQTT, settings, or firmware on devices lacking a WebPassword.
Severity Level
HIGH(7.5)
Published Date
Nov 9, 2026
Last Modified
Nov 10, 2026
Exploitation Status
No confirmed exploitation yet
EPSS Score (30-Day)
0.13%Probability
Root Weakness (CWE)
CWE-352: Cross-Site Request Forgery (CSRF) ↗
The web application does not sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v4.0 Base Metrics — Score 7.5 (HIGH)
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Attack VectorNetwork
Attack ComplexityHigh
Attack RequirementsNone
Privileges RequiredNone
User InteractionActive
Confidentiality (Vulnerable System)High
Integrity (Vulnerable System)High
Availability (Vulnerable System)High
Confidentiality (Subsequent System)None
Integrity (Subsequent System)None
Availability (Subsequent System)None
Show CVSS v3.x metrics (score 7.5)
CVSS v3.1 Base Metrics — Score 7.5 (HIGH)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityHigh
Privileges RequiredNone
User InteractionRequired
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

Affected & Patched Versions

Affected Versions
  • arendst Tasmota <= 16.0.0
Patched Versions
  • arendst Tasmota 16.0.0

What to do

Plan remediation soon. No exploitation is confirmed yet, but the severity is high.

  1. Check whether you run arendst Tasmota and which version.
  2. Update to a patched version listed above, then confirm the new version.

Timeline

  • Nov 9, 2026Published
  • Nov 10, 2026Record last modified

Score, severity and exploitation changes are tracked from the day Watchtower started logging them.

Get notified about new arendst Tasmota CVEsYou are reading CVE-2026-119755. Get an email when KEV listings, exploits or new CVEs match your stack.
Set up CVE alerts

More arendst Tasmota CVEs

External References

Data last checked: Nov 13, 2026 18:23 UTC