CVE-2023-4212 (published 2023-08-22T17:34:12.059Z)

​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.


Affected products: Vendor: ​Trane Technologies
Product: XL824 Thermostat
Versions: 0