Auth bypass in Network Thermostat X-Series Wifi Thermostats
CVE-2025-6260
The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.
Vulnerability class: Broken Authentication
EPSS: 0.005 (37.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Network Thermostat X-series Wifi Thermostats — versions v4.5, v9.6, v10.1
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2025-6260?
- CVE-2025-6260 is a critical-severity vulnerability in Network Thermostat X-Series Wifi Thermostats, classified under Missing Authentication for Critical Function. CVSS score: 9.8/10. Published 2025-07-24.
- How severe is CVE-2025-6260?
- Critical severity. CVSS v3 base score is 9.8 out of 10.