Heatmiser Wifi Thermostat firmware 1.7 contains a cross‑site request forgery flaw that permits an attacker to change the administrator username and password. By crafting an HTML form that posts to the networkSetup.htm endpoint with the usnm, usps, and cfps parameters, an authenticated user can be tricked into submitting the form and thereby alter the device’s credentials. The compromise grants the attacker full control of the thermostat and the ability to manipulate its settings and data.

The vulnerability affects Heatmiser Wi‑Fi Thermostat devices running firmware version 1.7. No other product or version numbers are listed, so any device with that firmware is potentially impacted.

The CVSS score of 5.3 indicates moderate severity; the flaw requires an authenticated user to load a malicious page, suggesting the attack vector is remote via the web interface. No EPSS data is available, and the vulnerability is not listed in the CISA KEV catalog, which implies a limited but non‑negligible risk. Without a patch, the issue remains exploitable as long as the affected firmware remains in use, and an attacker who succeeds can maintain persistent control over the thermostat.