Medium severity6.8NVD Advisory· Published Aug 22, 2023· Updated Jun 17, 2026

CVE-2023-4212

Description

A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Track\+/Pivot Firmware
cpe:2.3:o:trane:pivot_firmware:*:*:*:*:*:*:*:*
Range: <=1.8
Track\+/Xl1050 Firmware
cpe:2.3:o:trane:xl1050_firmware:*:*:*:*:*:*:*:*
Range: <=5.9.8
Track\+/Xl824 Firmware
cpe:2.3:o:trane:xl824_firmware:*:*:*:*:*:*:*:*
Range: <=5.9.8
Track\+/Xl850 Firmware
cpe:2.3:o:trane:xl850_firmware:*:*:*:*:*:*:*:*
Range: <=5.9.8
Track\+/XL824llm-create
Track\+/XL850llm-create
Track\+/XL1050llm-create
Trane/Pivot Thermostatllm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 0

Patches

Vulnerability mechanics

References

www.cisa.gov/news-events/ics-advisories/icsa-23-234-02nvdThird Party Advisory
https//www.cisa.gov/news-events/ics-advisories/icsa-23-234-02nvdBroken Link
hub.tranetechnologies.com/docs/DOC-216377nvdPermissions Required
www.trane.com/commercial/north-america/us/en/contact-us/locate-sales-offices.htmlnvdProduct

News mentions

No linked articles in our index yet.

cvss	0.442
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000