CVE-2013-4860
Radio Thermostat CT80 And CT50 with firmware 1.4.64 and earlier does not restrict access to the API, which allows remote attackers to change the operation mode, wifi connection settings, temperature thresholds, and other settings via unspecified vectors.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Radio Thermostat CT80 And CT50 with firmware 1.4.64 and earlier does not restrict access to the API, which allows remote attackers to change the operation mode, wifi connection settings, temperature thresholds, and other settings via unspecified vectors.
- CVSS 2.0
- 8.3 HIGHAV:A/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 1.96% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- radiothermostat/ct50 firmware · radiothermostat/ct50 · radiothermostat/ct80 firmware · radiothermostat/ct80
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/122657/Radio-Thermostat-Of-America-Inc-Lack-Of-Authentication.html
- http://www.securityfocus.com/bid/61581
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86197
- http://packetstormsecurity.com/files/122657/Radio-Thermostat-Of-America-Inc-Lack-Of-Authentication.html
- http://www.securityfocus.com/bid/61581
- https://exchange.xforce.ibmcloud.com/vulnerabilities/86197
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.