Overview of CISA Advisory on Network Thermostat X-Series Vulnerabilities (ICSA-25-205-02)

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory on July 24, 2025, warning of a critical vulnerability in Network Thermostat X-Series WiFi thermostats that could enable unauthenticated attackers to gain administrative access and reset user credentials. This flaw affects embedded web servers in specific thermostat models, potentially allowing remote compromise if devices are exposed via port forwarding or directly to the internet. No known public exploits have been reported, but CISA urges immediate patching and defensive measures to minimize risks, especially in commercial facilities where these thermostats are commonly deployed (primarily in the USA and Canada). The advisory is part of a batch of six ICS alerts released today, emphasizing proactive security in operational technology (OT) environments.Key facts from the advisory:

• Vulnerability Details: CVE-2025-6260 (Missing Authentication for Critical Function, CWE-306) allows unauthenticated attackers to access the thermostat's web interface and manipulate elements to reset credentials, gaining full administrative control.
• Affected Products and Versions: Network Thermostat X-Series WiFi Thermostats in versions v4.5 to <v4.6, v9.6 to <v9.46, v10.1 to <v10.29, and v11.1 to <v11.5.
• Risk Assessment: CVSS v3.1: 9.8 (Critical) – Attack Vector: Network, Complexity: Low, Privileges: None, User Interaction: None (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). CVSS v4: 9.3 (Critical) – Similar high exploitability with impacts on confidentiality, integrity, and availability (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).
• Potential Impacts: Attackers could gain full control over the device, potentially disrupting HVAC systems in commercial buildings or using it as a pivot for further network compromise.
• Exploitation Status: No known public exploitation reported to CISA at this time.
• Mitigations and Patches: Network Thermostat recommends updating to minimum versions v4.6, v9.46, v10.29, or v11.5 (or newer). Updates were applied automatically to reachable units; for firewalled devices, contact support@networkthermostat.com. CISA advises minimizing internet exposure, isolating control networks behind firewalls, using secure remote access like VPNs, and performing risk assessments before deploying defenses.
• Additional Information: Reported by researcher Souvik Kandar. CISA provides resources like Defense-in-Depth Strategies and encourages reporting suspicious activity.

This advisory highlights the growing risks in IoT/OT devices like smart thermostats, where exposure can lead to broader network compromises. For the full advisory or related ICS resources, check CISA's site.