CVE-2023-4212

🗓️ 22 Aug 2023 17:34:12Reported by icscertType

Command injection vuln in Trane thermostats, allows root access via US

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2023-4212	22 Aug 202322:28	–	circl
CNNVD	多款Trane产品命令注入漏洞	22 Aug 202300:00	–	cnnvd
Cvelist	CVE-2023-4212 Trane Thermostats Injection	22 Aug 202317:34	–	cvelist
EUVD	EUVD-2023-54086	3 Oct 202520:07	–	euvd
ICS	Trane Thermostats	22 Aug 202306:00	–	ics
NVD	CVE-2023-4212	22 Aug 202319:16	–	nvd
OSV	CVE-2023-4212	22 Aug 202319:16	–	osv
Prion	Command injection	22 Aug 202319:16	–	prion
Positive Technologies	PT-2023-28277 · Trane · Trane Pivot +3	22 Aug 202300:00	–	ptsecurity
Vulnrichment	CVE-2023-4212 Trane Thermostats Injection	22 Aug 202317:34	–	vulnrichment

NVD

Vulners

Node

trane xl824_firmwareRange≤5.9.8

AND

trane xl824Match-

Node

trane xl850_firmwareRange≤5.9.8

AND

trane xl850Match-

Node

trane xl1050_firmwareRange≤5.9.8

AND

trane xl1050Match-

Node

trane pivot_firmwareRange≤1.8

AND

trane pivotMatch-

[
  {
    "defaultStatus": "unaffected",
    "product": "XL824 Thermostat",
    "vendor": "Trane Technologies",
    "versions": [
      {
        "lessThanOrEqual": "5.9.8 ",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "XL850 Thermostat",
    "vendor": "Trane Technologies",
    "versions": [
      {
        "lessThanOrEqual": "5.9.8",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "XL1050 Thermostat",
    "vendor": "Trane Technologies",
    "versions": [
      {
        "lessThanOrEqual": "5.9.8 ",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Pivot Thermostat",
    "vendor": "Trane Technologies",
    "versions": [
      {
        "lessThanOrEqual": "1.8 ",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
hub	www.hub.tranetechnologies.com/docs/DOC-216377
trane	www.trane.com/commercial/north-america/us/en/contact-us/locate-sales-offices.html
https	www.https//www.cisa.gov/news-events/ics-advisories/icsa-23-234-02
cisa	www.cisa.gov/news-events/ics-advisories/icsa-23-234-02

21 Nov 2024 08:34Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.16.8

EPSS0.00106

SSVC