What’s Vulnerable › Vulnerabilities

CVE-2018-25396: Heatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htm

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-29 · updated 2026-07-21
• Weakness: CWE-256

Description

Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve administrative credentials by accessing the networkSetup.htm page. Attackers can request the networkSetup.htm endpoint and extract plaintext username and password values from HTML form fields to gain administrative access to the thermostat.

Affected products

• Heatmiser Wifi Thermostat: 1.7

References

• https://www.exploit-db.com/exploits/45623
• https://www.vulncheck.com/advisories/heatmiser-wifi-thermostat-credential-disclosure-via-networksetup-htm

Get alerted when CVE-2018-25396 or the next vulnerability affects your stack