CVE-2025-6260

Network Thermostat X-Series WiFi Thermostats Missing Authentication for Critical Function

Description

The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.

Remediation

Solution:

  • Network Thermostat recommends users to update to the following (or newer) versions: * X-Series WiFi thermostats with v4.x to a minimum of v4.6 * X-Series WiFi thermostats with v9.x to a minimum of v9.46 * X-Series WiFi thermostats with v10.x to a minimum of v10.29 * X-Series WiFi thermostats with v11.x to a minimum of v11.5 This update was applied automatically to reachable units, requiring no action from end users. If end users would like their units behind firewalls to be updated, contact Network Thermostat at support@networkthermostat.com to coordinate an update.

Category

9.3
CVSS
Severity: Critical
CVSS 4.0 •
CVSS 3.1 •
EPSS 0.06%
Affected: Network Thermostat X-Series WiFi thermostats
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/news-events/ics-advisories/icsa-25-205-02

Frequently Asked Questions

What is the severity of CVE-2025-6260?
CVE-2025-6260 has been scored as a critical severity vulnerability.
How to fix CVE-2025-6260?
To fix CVE-2025-6260: Network Thermostat recommends users to update to the following (or newer) versions: * X-Series WiFi thermostats with v4.x to a minimum of v4.6 * X-Series WiFi thermostats with v9.x to a minimum of v9.46 * X-Series WiFi thermostats with v10.x to a minimum of v10.29 * X-Series WiFi thermostats with v11.x to a minimum of v11.5 This update was applied automatically to reachable units, requiring no action from end users. If end users would like their units behind firewalls to be updated, contact Network Thermostat at support@networkthermostat.com to coordinate an update.
Is CVE-2025-6260 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2025-6260 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-6260?
CVE-2025-6260 affects Network Thermostat X-Series WiFi thermostats.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.