CVE-2023-4212

CVE-2023-4212 affects Trane XL824, XL850, XL1050, and Pivot thermostats. A command injection allows an attacker to run arbitrary commands as root via a specially crafted filename when physical access is granted through a USB stick. Public documents confirm vulnerable firmware versions: XL824/XL85...