Vulnerability CVE-2013-4860
Published: 2014-06-05

Description:
Radio Thermostat CT80 And CT50 with firmware 1.4.64 and earlier does not restrict access to the API, which allows remote attackers to change the operation mode, wifi connection settings, temperature thresholds, and other settings via unspecified vectors.

See advisories in our WLB2 database:
Topic
Author
Date
High
Radio Thermostat Of America Inc Lack Of Authentication
Daniel Crowley
02.08.2013

Type:

CWE-264

 (Permissions, Privileges, and Access Controls)

CVSS2 => (AV:A/AC:L/Au:N/C:C/I:C/A:C)

CVSS Base Score
Impact Subscore
Exploitability Subscore
8.3/10
10/10
6.5/10
Exploit range
Attack complexity
Authentication
Adjacent network
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
Complete
Complete
Affected software
Radiothermostat -> CT50 
Radiothermostat -> CT80 
Radiothermostat -> Ct50 firmware 
Radiothermostat -> Ct80 firmware 

 References:
http://xforce.iss.net/xforce/xfdb/86197
http://www.securityfocus.com/bid/61581
http://packetstormsecurity.com/files/122657/Radio-Thermostat-Of-America-Inc-Lack-Of-Authentication.html
Copyright 2024, cxsecurity.com

 

Back to Top