Recent Vulnerabilities Research Posts Trends Blog About Contact

Published: 20/05/2018 Updated: 07/11/2023

CVSS v2 Base Score: 3.3 | Impact Score: 2.9 | Exploitability Score: 6.5

CVSS v3 Base Score: 6.5 | Impact Score: 3.6 | Exploitability Score: 2.8

VMScore: 294

Vector: AV:A/AC:L/Au:N/C:N/I:P/A:N

The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat t_heat request that accesses a device purchased in the Spring of 2018, and sets a home's target temperature to 95 degrees Fahrenheit. This vulnerability might be described as an addendum to CVE-2013-4860.

Vulnerable Product	Search on Vulmon	Subscribe to Product
radiothermostat ct50_firmware
radiothermostat ct80_firmware

CWE-20 https://github.com/brannondorsey/radio-thermostat https://www.wired.com/story/chromecast-roku-sonos-dns-rebinding-vulnerability https://medium.com/%40brannondorsey/attacking-private-networks-from-the-internet-with-dns-rebinding-ea7098a2d325 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2018-11315

Vulnerability Summary

References

Vulmon Search

About

Products

Connect