Popular WiFi thermostat full of security holes

cybergibbons writes: Heatmiser, a U.K.-based manufacturer of digital thermostats, is contacting its customers today about a series of security issues that could expose a Wi-Fi-connected version of its product to takeover.

Andrew Tierney, a “reverse-engineer by night,” whose specialty is digging up bugs in embedded systems wrote on his blog cybergibbons.com, that he initially read about vulnerabilities in another one of the company’s products, NetMonitor, and decided to poke around its product line further.

This led him to discover a slew of issues in the company’s Wi-Fi-enabled thermostats running firmware version 1.2. The issues range from simple security missteps to critical oversights.