CVE-2023-27482
Exploitation confirmed. First attested on 2023-10-14 by GCVE · kevintel, GCVE · shadowserver.
- Published2023-03-08
- Fixed in2023.3.0
- WeaknessCWE-287
Am I affected?
Debian, Ubuntu or Red Hat sometimes backport a fix without changing the upstream version number: such a version reads « to verify », never « affected ».With a domain, we read the version its public headers and pages expose. A distribution build can carry the fix under an older number.
Description
homeassistant is an open source home automation tool. A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. This impacts all Home Assistant installation types that use the Supervisor 2023.01.1 or older. Installation types, like Home Assistant Container (for example Docker), or Home Assistant Core manually in a Python environment, are not affected. The issue has been mitigated and closed in Supervisor version 2023.03.1, which has been rolled out to all affected installations via the auto-update feature of the Supervisor. This rollout has been completed at the time of publication of this advisory. Home Assistant Core 2023.3.0 included mitigation for this vulnerability. Upgrading to at least that version is thus advised. In case one is not able to upgrade the Home Assistant Supervisor or the Home Assistant Core application at this time, it is advised to not expose your Home Assistant instance to the internet.
Timeline
dates in UTC- 2023-03-0818:15CVE publishedNVD
- 2023-10-1404:05Listed as exploited by GCVEGCVE
- 2023-10-1404:05Exploitation first reportedGCVE
Observed activity
isMalicious corpus · updated 2026-11-03 21:37 UTCBlock these indicators
- Firewall list (EDL, text): https://api.ismalicious.com/edl/cve/CVE-2023-27482?format=txt
- CSV export: https://api.ismalicious.com/edl/cve/CVE-2023-27482?format=csv
- TAXII collection of exploited CVEs
- The EDL and CSV take an API key on the Pro plan.
Versions per branch
NVD| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| 2023.3 | < 2023.3.0 | 2023.3.0 | NVD |
| Branch | Affected | Fixed in | Source |
|---|---|---|---|
| 2023.3 | < 2023.03.1 | 2023.03.1 | NVD |
as publishedRanges as NVD and OSV publish them; a distribution’s build can be fixed under an older number.
Products declared by the CNA2 products
As GitHub_M, the CNA that assigned this CVE, declared them in the CVE record; versions as written.
- home-assistant coreAffected
- = < 2023.3.2no fix stated
- home-assistant supervisorAffected
- = < 2023.03.3no fix stated
Source: the CNA record (CVE Program), © The MITRE Corporation,CVE Terms of UseCVE recordupdated 2023-05-17
Distribution builds and vendor advisories
Packages from OSV.dev and products from the vendors' CSAF advisories.
version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.
Packages
- supervisorWolfiall versions · fixed in 0
- supervisorRoot:Alpine:3.19all versions · fixed in 4.2.5-r40071and 1 other package
- supervisorRoot:Alpine:3.19all versions · fixed in 4.2.5-r40072and 1 other package
- supervisorRoot:Alpine:3.19all versions · fixed in 4.2.5-r40073and 1 other package
- supervisorRoot:Alpine:3.19all versions · fixed in 4.2.5-r40074and 1 other package
- supervisorRoot:Alpine:3.19all versions · fixed in 4.2.5-r40075and 1 other package
- supervisorChainguardall versions · fixed in 0
Fix
- Update Home-assistant to 2023.3.0
Advisories and patches
- github.comVendor Advisory
- www.home-assistant.ioVendor Advisory
Detection
read 2026-11-02 22:42 UTC- Nuclei template
- available ProjectDiscovery
- Exploit-DB
- no entry Exploit-DB
- Proof-of-concept repositories
- none listed PoC-in-GitHub
- Metasploit modules
- none listed Metasploit Framework
Sources
- GCVEexploitation2023-10-14
- CISA-ADPSSVC decisionnone2025-02-25
- OpenCVESSVC decisionnone—
- CNACVSS 3.110known since 2026-10-23
- NVDCVSS 3.110read 2026-10-23
- CNAweakness (CWE)CWE-287known since 2026-10-23
- FIRST EPSSEPSS score72.2 %read 2026-11-02
- ProjectDiscoverydetectionread 2026-11-02
- OSVaffected packages—
Identifiers
- CGA-77ch-2vq3-hwfpsame flawChainguard · CC-BY-NC-ND-4.0
- CGA-pcgj-v4m8-9prcsame flawChainguard · CC-BY-NC-ND-4.0
- EUVD-2023-31251same flawENISA EUVD · LicenseRef-ENISA-legal-notice
Technical details
- CVSS v3 Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Published
- 2023-03-08
- Last Modified
- 2026-06-17
- NVD status
- Modified
Frequently asked questions
What is CVE-2023-27482?
Is CVE-2023-27482 actively exploited?
What is the CVSS score for CVE-2023-27482?
Running supervisor? Hear about its next vulnerability
Surveillance reads the versions in your stack — a domain, a lockfile or a list — checks each CVE against the ranges its sources publish, and alerts you when one you run is exploited or enters CISA KEV. A version it cannot read stays « version not verified ».
No credit card required · No monthly cap on website lookups · 250 API requests/month
Go further
- For a threat intelligence platform: malware, C2 and ransomware indicators over STIX/TAXII.
- Following what attackers exploit right now? The CISA KEV additions of the month, with their patch deadlines.
- Running this software? Vulnerability monitoring alerts you to new vulnerabilities in your products.
Related vulnerabilities
Same product first, then the same vendor advisory and the same publication week.
Sources for this record
- CVE Program · CVE Program Terms of Use
- ENISA EU Vulnerability Database · ENISA legal notice §1.2 (reproduction authorised, provided the source is acknowledged)
- FIRST EPSS · EPSS terms of use (free use, attribution requested)
- GCVE · GCVE dump terms (preserve source attribution)
- Nuclei templates · MIT
- NVD · Public domain (17 U.S.C. § 105) for NVD-authored data; third-party content under its own terms
- OpenCVE · OpenCVE terms of service · terms restrict redistribution
- OSV.dev · Per record, as its publisher states it: each row carries the label in sourceLicense when one is served
- CISA Vulnrichment · CC0-1.0