PT-2026-7922 · Heatmiser · Heatmiser Netmonitor

Ismail Tasdelen · Published 2026-02-12 · Updated 2026-02-12 · CVE-2019-25322

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Heatmiser Netmonitor version 3.03

Description The software contains hardcoded credentials, specifically a predictable username and password for administrative access. An attacker can gain access to the device by using the username 'admin' and password 'admin' within the hidden form input fields of the 'networkSetup.htm' page.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2019-25322

Affected Products

Heatmiser Netmonitor

References · 7

• 🔥 https://exploit-db.com/exploits/47823 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25322 · Security Note
• https://t.me/CVEtracker/44565 · Telegram Post
• https://t.me/cveNotify/151907 · Telegram Post
• https://web.archive.org/web/20190724160628/https://heatmiser.com/en · Note
• https://zoneregeling.nl/heatmiser/netmonitor-handleiding.pdf · Note
• https://vulncheck.com/advisories/heatmiser-netmonitor-hardcoded-credentials · Note