Hackers can hijack your Bosch Thermostat and Install Malware

Bitdefender Labs disclosed a vulnerability (CVE-2023-49722) in the Bosch BCC100 thermostat (affected versions 1.7.0 – HD 4.13.22) that allows an attacker to forge cloud/update responses and push rogue firmware via the Wi‑Fi chip’s TCP/WebSocket interface—potentially enabling remote manipulation of settings and installation of malware; Bitdefender responsibly disclosed the issue in January 2024 and Bosch issued an advisory and started remediation. Users are advised to update firmware, change default passwords, limit internet exposure, and use network controls.