Bug hunter Andrew Tierney discovered over 7000 vulnerable thermostats connected to the net. He discovered that the devices were vulnerable to a number of threats including cross-site request forgery (CSRF) attacks. Tierney also discovered that once logged into a Heatmiser device, the users username, password, WiFi SSID and WiFi password are all filled into the form and can be viewed easily by examine the source of the webpage. The firm has now emailed its customers a brief security advisory.”]
Source: https://grahamcluley.com/heatmiser-wifi-thermostats-password-leak/