Information disclosure

The Local HTTP API in Radio Thermostat CT50 and CT80 1.04.84 and below products allows unauthorized access via a DNS rebinding attack. This can result in remote device temperature control, as demonstrated by a tstat theat request that accesses a device purchased in the Spring of 2018, and sets a...

CVE-2013-4860

The CVE-2013-4860 issue affects Radio Thermostat CT50/CT80 units with firmware 1.4.64 and earlier, where the Local HTTP/API did not require authentication, enabling remote attackers on the same network to modify operation mode, WiFi settings, temperature thresholds, and other settings via unspeci...

Radio Thermostat Of America, Inc Lack Of Authentication

Trustwave SpiderLabs Security Advisory TWSL2013-022: No Authentication Vulnerability in Radio Thermostat of America, Inc Published: 08/01/13 Version: 1.0 Vendor: Radio Thermostat of America, Inc Product: CT80, CT50 Version affected: v1.4.64 and earlier Product description: The Radio Thermostat CT...