Researcher Warns of Holes In Smart Thermostats
ID: 4d7e0d66-015c-597d-a28a-4624d6b30c94
STIX ID: report--4d7e0d66-015c-597d-a28a-4624d6b30c94
Feed Name: Security Ledger
Trustwave researcher Jeff Kitson discovered that Trane ComfortLink XL850 thermostats (firmware 3.1 and earlier) include hardcoded admin credentials and a predictable, network-accessible management port, enabling remote takeover or privacy invasion; additionally, Nexia-maintained GitHub repositories exposed configuration files, encryption salts, and secret keys. Trustwave notified Trane and Nexia, confidential code was cleaned up from public repositories, and Trane began issuing updates to deployed devices starting in July.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.