CVE-2018-25396 Heatmiser Wifi Thermostat 1.7 Credential Disclosure via networkSetup.htm
Unauthenticated attackers can retrieve administrative credentials from the networkSetup.htm page to gain full control of the Heatmiser Wifi Thermostat.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-25396?
CVE-2018-25396 is a high-severity vulnerability in Heatmiser Wifi Thermostat, published on 29 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Heatmiser Wifi Thermostat 1.7 contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve administrative credentials by accessing the networkSetup.htm page. Attackers can request the networkSetup.htm endpoint and extract plaintext username and password values from HTML form fields to gain administrative access to the thermostat.
Weakness: CWE-256
Which versions are affected by CVE-2018-25396?
How do I fix CVE-2018-25396?
No fix has been published for CVE-2018-25396 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-25396 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-25396 exists.
Sources
Also known as GHSA-g2j8-j26j-56qh.