PT-2026-32170 · Heatmiser · Heatmiser Wifi Thermostat+1

Sajjadbnd · Publicado 2026-04-12 · Atualizado 2026-04-12 · CVE-2019-25708

Mitre

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Heatmiser Wifi Thermostat 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials by tricking authenticated users into submitting malicious requests. Attackers can craft HTML forms targeting the networkSetup.htm endpoint with parameters usnm, usps, and cfps to modify the admin username and password without user consent.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2019-25708

Produtos afetados

Heatmiser Wifi Thermostat

Wifi Thermostat

Referências · 3

• 🔥 https://exploit-db.com/exploits/46100 · Exploit
• https://vulncheck.com/advisories/heatmiser-wifi-thermostat-cross-site-request-forgery · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-25708 · Nota de Segurança