CVE-2023-41894
Home-Assistant ≤ 2023.9.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-41894 is a medium-severity Incorrect Resource Transfer Between Spheres (CWE-669) vulnerability in Home-Assistant Home-Assistant. Its CVSS base score is 5.3 (Medium).
Operationally, ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-46373
Vulnerability Data
Home assistant is an open source home automation. The assessment verified that webhooks available in the webhook component are triggerable via the `*.ui.nabu.casa` URL without authentication, even when the webhook is marked as Only accessible from the local network. This…
more
issue is facilitated by the SniTun proxy, which sets the source address to 127.0.0.1 on all requests sent to the public URL and forwarded to the local Home Assistant. This issue has been addressed in version 2023.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Enforces proper authorization rules for any resource or data transfer between different spheres.
Accountability, documentation, and protection requirements ensure correct transfer of media resources between spheres.
Reduces incorrect transfers between spheres by establishing clear, separate domains for different sensitivities or functions.
It governs all resource transfers between spheres, preventing incorrect or unauthorized movement of data or capabilities across domain interfaces.
Addresses incorrect transfer of resources to an uncontrolled sphere by requiring approved destruction or sanitization methods.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Information-transfer rules can prevent improper resource hand-off between spheres.
Access-control policies limit unintended control over transferred resources.
Managing access rights reduces risk of unauthorized resource transfer.
Network-security controls can block improper cross-sphere transfers.
Network segregation directly limits unintended resource movement between spheres.
Secure SDLC practices can catch incorrect resource-transfer flaws early.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.