Skip to content
CVE PROGRAM SOURCE RECORD6.8 Medium

CVE-2023-4212

Trane Thermostats Injection

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
icscert

Description

​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

​Trane Technologies XL824 Thermostat

Default version status: unaffected

  • 0 to ≤ 5.9.8 affected

​Trane Technologies XL850 Thermostat

Default version status: unaffected

  • 0 to ≤ 5.9.8affected

​Trane Technologies XL1050 Thermostat

Default version status: unaffected

  • 0 to ≤ 5.9.8 affected

Trane Technologies Pivot Thermostat

Default version status: unaffected

  • 0 to ≤ 1.8 affected

References