CVE-2025-6260 — Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

CVE-2025-6260

Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function PUBLISHED

Description (CNA)

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.

Affected (CNA)

Vendor / product	Versions
Network Thermostat / X-Series WiFi thermostats	affected v4.5 before 4.6; affected v9.6 before v9.46; affected v10.1 before v10.29; affected v11.1 before v11.5

CWE

CWE-306

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-02

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.