PatchTheCVEthermostat vulnerabilities and fixes
Recent CVEs affecting thermostat, with upgrade or downgrade steps. 2 tracked.
thermostat has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2015-06-08. Highest priority: CVE-2015-3201 (score 28/100).
- CVE-2015-3201 LOW 2.1 UPGRADE Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local
- CVE-2014-8120 MEDIUM 4.4 UPGRADE The agent in Thermostat before 1.0.6, when using unspecified configurations, allows local users to obtain the
FAQ
How do I fix thermostat vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is thermostat being exploited right now?
None of the tracked thermostat CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which thermostat CVE should I patch first?
CVE-2015-3201 currently ranks highest (28/100): Thermostat before 2.0.0 uses world-readable permissions for the web.xml configuration file, which allows local.