Description
The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.
Published: 2025-07-24
Score: 9.3 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Network Thermostat recommends users to update to the following (or newer) versions: * X-Series WiFi thermostats with v4.x to a minimum of v4.6 * X-Series WiFi thermostats with v9.x to a minimum of v9.46 * X-Series WiFi thermostats with v10.x to a minimum of v10.29 * X-Series WiFi thermostats with v11.x to a minimum of v11.5 This update was applied automatically to reachable units, requiring no action from end users. If end users would like their units behind firewalls to be updated, contact Network Thermostat at support@networkthermostat.com to coordinate an update.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-22544 The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.
History

Fri, 25 Jul 2025 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Jul 2025 21:00:00 +0000

Type Values Removed Values Added
Description The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.
Title Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function
Weaknesses CWE-306
References
Metrics cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2025-07-25T13:31:50.926Z

Reserved: 2025-06-18T22:35:45.412Z

Link: CVE-2025-6260

cve-icon Vulnrichment

Updated: 2025-07-25T13:31:46.205Z

cve-icon NVD

Status : Deferred

Published: 2025-07-24T21:15:52.447

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-6260

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses