CVE-2025-6260 — Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function
The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Inter…
Published: 2025-07-24 · CVSS: 9.3 · CVSS 4.0
The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7