CVE-2023-4212
Medium
Description
A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.
SeverityMedium
CVSS6.8
Exploit probability—
ProductTrane Xl824 Firmware
PublishedAug 22, 2023
First seenAug 22, 2023
Weakness typeCWE-74Injection
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| trane xl824_firmware | v ≤ 5.9.8 | — |
| trane xl850_firmware | v ≤ 5.9.8 | — |
| trane xl1050_firmware | v ≤ 5.9.8 | — |
| trane pivot_firmware | v ≤ 1.8 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.