CVE-2013-4860: Radio Thermostat CT80 And CT50 with firmware 1.4.64 and earlier does not restrict access to the API, which...

Security readout for executives and security teams

Some Radio Thermostat CT80 and CT50 devices expose controls without proper API access restrictions. If reachable by an untrusted party, the thermostat could be reconfigured, including operating mode, temperature thresholds, and Wi-Fi settings. The public record does not confirm active exploitation or provide a scored severity. Exposure is likely limited to CT80 or CT50 thermostats on firmware 1.4.64 or earlier where the API is reachable from untrusted networks. Risk rises if devices are Internet-accessible, shared with guest Wi-Fi, or reachable from compromised internal hosts. Treat as high priority for facilities, retail, healthcare, or any site where thermostat disruption could affect operations, comfort, or equipment. Prioritize exposed devices first because public records do not provide a confirmed vendor fix. Mitigation focus: Identify CT80 and CT50 devices and record firmware versions.; Check vendor guidance for fixed firmware or replacement options.; Remove thermostat API access from the Internet and guest networks..

Prepared

Jun 14, 2026, 14:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.