CVE-2026-116017 xinnan-tech CVE debrief

Who should care

Defenders responsible for Xiaozhi-esp32-server instances should assess exposure and prioritize upgrading to version 0.9.8 or later. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify instance exposure, review the supplied official advisory or CVE record, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Why it matters

CVE-2026-116017 is a medium-severity IDOR vulnerability in Xiaozhi-esp32-server before 0.9.8. Authenticated users can access other users' device address books, potentially leading to unauthorized access or lateral movement. Defenders should verify exposure, prioritize upgrading to 0.9.8 or later, and restrict access to the /device/address-book endpoint.

• Authenticated users can access sensitive device address book information
• Potential for lateral movement or unauthorized access
• Requires verification of instance exposure and version
• Upgrade to 0.9.8 or later to remediate

Technical summary

The Xiaozhi-esp32-server before version 0.9.8 contains an insecure direct object reference vulnerability in the manager-api DeviceController.getAddressBook handler. This allows authenticated users to read other users' device address books by requesting /device/address-book/{macAddress} with another user's device MAC. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Defenders should prioritize verifying exposure of Xiaozhi-esp32-server instances and upgrading to version 0.9.8 or later to remediate the vulnerability.

Defensive priority

Defenders should prioritize verifying exposure of Xiaozhi-esp32-server instances and upgrading to version 0.9.8 or later.

Recommended defensive actions

• Verify Xiaozhi-esp32-server version and upgrade to 0.9.8 or later if necessary
• Restrict access to the /device/address-book endpoint
• Monitor for unauthorized access attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from the CVE Program and NVD confirms the IDOR vulnerability in Xiaozhi-esp32-server before 0.9.8. Limited details on exploitation or impact are provided. Defenders should verify instance exposure and review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The CVE record was published on 2026-10-24T11:40:34.247Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.