by Kastro
Paper/Archive/CVE-2025-6260

CVE-2025-6260

Network Thermostat X-Series WiFi thermostats — Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.8.468 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.

Affected

ProductAffectedFixed inSource
X-Series WiFi thermostatsv4.5 – < 4.64.6CNA
X-Series WiFi thermostatsv9.6 – < v9.46v9.46CNA
X-Series WiFi thermostatsv10.1 – < v10.29v10.29CNA
X-Series WiFi thermostatsv11.1 – < v11.5v11.5CNA

Scores by source

icscert (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-advisories/icsa-25-205-02