What’s Vulnerable › Vulnerabilities

CVE-2018-11315

• Severity: medium (CVSS 6.5 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-05-20 · updated 2026-06-17
• Weakness: CWE-20

Description

The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat t_heat request that accesses a device purchased in the Spring of 2018, and sets a home's target temperature to 95 degrees Fahrenheit. This vulnerability might be described as an addendum to CVE-2013-4860.

Affected products

• Radiothermostat Ct50 Firmware: through 1.04.84
• Radiothermostat Ct80 Firmware: through 1.04.84

References

• https://github.com/brannondorsey/radio-thermostat
• https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
• https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability
• https://github.com/brannondorsey/radio-thermostat
• https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325
• https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability

Get alerted when CVE-2018-11315 or the next vulnerability affects your stack