PT-2026-44874 · Undefined · Undefined

Publicado 2026-05-29 · Atualizado 2026-05-29 · CVE-2018-25396

NVD

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve administrative credentials by accessing the networkSetup.htm page. Attackers can request the networkSetup.htm endpoint and extract plaintext username and password values from HTML form fields to gain administrative access to the thermostat.

Correção

Enumeração de Fraquezas

CWE-256

Identificadores relacionados

CVE-2018-25396

Produtos afetados

Undefined

Referências · 3

• https://exploit-db.com/exploits/45623 · Nota
• https://vulncheck.com/advisories/heatmiser-wifi-thermostat-credential-disclosure-via-networksetup-htm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-25396 · Nota de Segurança