CVE-2023-4212 Trane Thermostats Injection

​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick...

Trane Thermostats

1. EXECUTIVE SUMMARY ​CVSS v3 6.8 ​ATTENTION: Low attack complexity ​Vendor: Trane ​Equipment: XL824, XL850, XL1050, and Pivot thermostats ​Vulnerability: Injection 2. RISK EVALUATION ​Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as root...

Multiple Trane products have command injection vulnerabilities

The Trane XL824 and others are a smart thermostat from Trane Ireland Trane. The Trane XL824, XL850, and XL1050 are vulnerable to a command injection vulnerability that stems from the presence of a command injection vulnerability that allows an attacker to execute arbitrary commands as root using...

CVE-2023-4212: Improper Neutralization of Special Elements in Output Used by a Downstream Component

​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick...