CVE-2019-25708

CVE-2019-25708 is a cross-site request forgery (CSRF) vulnerability affecting Heatmiser Wifi Thermostat version 1.7. The flaw enables attackers to alter administrator credentials by deceiving authenticated users into submitting malicious requests to the networkSetup.htm endpoint using crafted HTML forms with specific parameters. The vulnerability has a low CVSS score of 3.5, requiring network access and user interaction to exploit. It necessitates an authenticated attacker who can trick a logged-in administrator into visiting a malicious page, resulting in limited integrity impact through unauthorized credential modification. The attack vector is network-based with low complexity. This vulnerability shows minimal exploitation activity and community attention. It is not included on the KEV catalog, indicating no evidence of active exploitation in the wild. The EPSS score of 0.00005 places it below the median risk threshold, suggesting low probability of near-term exploitation. This CVE should be prioritized lower than more critical threats but patching should still be considered as part of routine maintenance cycles.