Patch/Configuration Management, Vulnerability Management

Vulnerabilities in Trane thermostats heat up IoT safety concerns


Talos yesterday disclosed a trio of dangerous Internet of Things (IoT) vulnerabilities that were discovered and subsequently patched in smart thermostats manufactured by HVAC company Trane.

Researchers from Talos, an offshoot of Cisco Systems, first discovered flaws in the connected thermostat — sold under the brand new ComfortLink II — in April 2014. Trane patched two of the bugs in April 2015 and fixed the third vulnerability as of Jan. 27, 2016.

The vulnerabilities could have allowed bad actors to remotely access and operate the thermostats, as well as trigger arbitrary code to use the device as conduit for local network and external network attacks, Talos said in a blog post. The research group also recommended that ComfortLink II owners update their firmware immediately, as it was unclear if Trane had "effectively communicated the necessity of installing these updates to their customers."

“While IoT devices such as smart thermostats, home lighting and security systems bring an added level of convenience into our lives, these vulnerabilities highlight the dangers of insecure development practices,” Talos cautioned.

Bradley Barth

As director of multimedia content strategy at CyberRisk Alliance, Bradley Barth develops content for online conferences, webcasts, podcasts video/multimedia projects — often serving as moderator or host. For nearly six years, he wrote and reported for SC Media as deputy editor and, before that, senior reporter. He was previously a program executive with the tech-focused PR firm Voxus. Past journalistic experience includes stints as business editor at Executive Technology, a staff writer at New York Sportscene and a freelance journalist covering travel and entertainment. In his spare time, Bradley also writes screenplays.

Get daily email updates

SC Media's daily must-read of the most current and pressing daily news

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy.