CVE-2023-4212
Trane Thermostats Injection
A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.
CVSS 3.1 · 6.8 Medium
EPSS 1.3%
KEV · Not listed
Vendors
Products