CVE-2019-25708

EIP tracks 1 public exploit for CVE-2019-25708. PoCs published by SajjadBnd.

AI-analyzed exploit summary This is a functional CSRF exploit for Heatmiser Wifi Thermostat 1.7, allowing an attacker to change admin credentials via a crafted HTML form. The exploit leverages the lack of CSRF protection in the device's web interface.

Heatmiser Wifi Thermostat 1.7 contains a cross-site request forgery vulnerability that allows attackers to change administrator credentials by tricking authenticated users into submitting malicious requests. Attackers can craft HTML forms targeting the networkSetup.htm endpoint with parameters usnm, usps, and cfps to modify the admin username and password without user consent.