Heatmiser Wifi Thermostat firmware version 1.7 contains a credential disclosure flaw that lets an unauthenticated attacker retrieve the administrator username and password by requesting the networkSetup.htm page. The vulnerability arises from the thermostat presenting these credentials in plaintext within HTML form fields, allowing direct extraction without prior authentication. This exposes the appliance to full administrative control, compromising both confidentiality and integrity.

The affected product is the Heatmiser Wifi Thermostat running firmware 1.7. No other vendors, products, or firmware versions are listed as impacted.

The flaw has a CVSS score of 8.7, indicating a high severity. EPSS information is unavailable, so the current probability of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit it remotely by sending an unauthenticated HTTP request to the thermostat’s web interface, specifically the networkSetup.htm endpoint; the required conditions are simply network connectivity to the device.