CyberRota Analysis
This is a critical severity vulnerability with a CVSS score of 9.8. Exploitation may require the attacker to be authenticated.
CVE
CVE-2025-6260
Severity
CRITICAL
CVSS
9.8
EPSS
0.46%
Original NVD Description
The embedded web server on the thermostat listed version ranges contain a vulnerability that allows unauthenticated attackers, either on the local area network or from the Internet via a router with port forwarding set up, to gain direct access to the thermostat's embedded web server and reset user credentials by manipulating specific elements of the embedded web interface.