Nozomi Networks conducted a comprehensive security analysis and dissection of the ESP-NOW protocol, and this white paper details the findings from our research. We begin by outlining the main features of ESP-NOW and dissecting the frame format utilized in the protocol. Following this introduction, we explain our vulnerability assessment process, which employed automated code analysis tools such as SemGrep and Weggli. These tools helped us identify critical segments of the code that required further investigation.

Ultimately, our research uncovered two potential vulnerabilities. The first, an Out-of-Band read access, was determined to be non-exploitable upon deeper analysis. The second, a replay attack vulnerability, proved to be exploitable. We provide a detailed analysis of this vulnerability and include a proof of concept to demonstrate the potential security implications associated with ESP-NOW.