ZDI 2026-08-12

ZDI-26-563: (Pwn2Own) Home Assistant Green Simple Service Discovery Protocol Server-Side Request Forgery Vulnerability

Machine-generated analysis · WAYSCloud LLM

Unauthenticated network-adjacent attackers can trigger arbitrary server-side requests via Home Assistant Green's Simple Service Discovery Protocol server.

Context

The advisory concerns Home Assistant Green's Simple Service Discovery Protocol (SSDP) server. It describes an unauthenticated server-side request forgery (SSRF) that allows network-adjacent attackers to initiate arbitrary requests. The CVSS score assigned is 5.4.

Operator considerations

Check: inventory Home Assistant Green instances with the SSDP server enabled.
Isolate: restrict network access to the SSDP service to trusted hosts only.

From Zero Day Initiative ↗

This vulnerability allows network-adjacent attackers to initiate arbitrary server-side requests on affected installations of Home Assistant Green. Authentication is not required to exploit this vulnerability. The ZDI has assigned a CVSS rating of 5.4.

Read the full advisory on ZDI →