CVE-2025-6260

Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

State: Published
Severity: 9.3 Critical
Published: Jul 24, 2025
Updated: Jul 25, 2025
Reserved: Jun 18, 2025

Description

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.

Scores

CVSS	Score	Vector	Source
4.0	9.3 Critical	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	icscert
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-306 Missing Authentication for Critical Function

Affected Products

Product	Versions
X-Series WiFi thermostatsNetwork Thermostat	v4.5 to before 4.6Affected v9.6 to before v9.46Affected v10.1 to before v10.29Affected v11.1 to before v11.5Affected

References

https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-02

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.