Vulnerability · Published Aug 22, 2023 · Assigned by icscert
CVE-2023-4212Trane Thermostats Injection
Medium 6.8
In plain English
A medium-severity injection in Pivot Thermostat from Trane Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).
Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)1.3%top 28.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Trane Technologies | XL824 Thermostat | 0 – through 5.9.8 |
| Trane Technologies | XL850 Thermostat | 0 – through 5.9.8 |
| Trane Technologies | XL1050 Thermostat | 0 – through 5.9.8 |
| Trane Technologies | Pivot Thermostat | 0 – through 1.8 |
Weakness: CWE-74 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H