CVE-2025-6260 Details

A vulnerability has been identified in the embedded web server of Network Thermostat X-Series WiFi thermostats, specifically in versions 4.5 prior to 4.6, 9.6 prior to 9.46, 10.1 prior to 10.29, and 11.1 prior to 11.5. This vulnerability allows unauthenticated attackers to gain direct access to the thermostat's web server. Exploitation can occur from the local area network or over the Internet if port forwarding is enabled on the router. Once accessed, attackers can manipulate elements of the web interface to reset user credentials.

Users are advised to update their X-Series WiFi thermostats to version 4.6 or later, version 9.46 or later, version 10.29 or later, or version 11.5 or later. This update was automatically applied to reachable units. For units behind firewalls, contact Network Thermostat to coordinate an update.