CVE-2026-116017 | xinnan-tech xiaozhi-esp32-server up to 0.9.7 AddressBook /device/address-book DeviceController.getAddressBook macAddress resource injection

SecurityVulns
Yanac

A vulnerability labeled as problematic has been found in xinnan-tech xiaozhi-esp32-server up to 0.9.7. The impacted element is the function DeviceController.getAddressBook of the file /device/address-book of the component AddressBook. The manipulation of the argument macAddress results in improper control of resource identifiers.

This vulnerability is cataloged as CVE-2026-116017. The attack may be launched remotely. There is no exploit available.

The affected component should be upgraded.VulDB Recent EntriesRead More