Skip to content
CVE PROGRAM SOURCE RECORD9.3 Critical

CVE-2025-6260

Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Network Thermostat X-Series WiFi thermostats

Default version status: unaffected

  • v4.5 to < 4.6affected
  • v9.6 to < v9.46affected
  • v10.1 to < v10.29affected
  • v11.1 to < v11.5affected

References