CVE-2023-4212
MediumCVSS 6.8Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.
Risk Assessment
This vulnerability poses a risk of unauthorized access to the system, potentially leading to serious security implications for the device and network. An attacker gains full control over the device.
Recommendation
It is recommended to restrict physical access to the devices and monitor USB port usage. Consider updating the device firmware if patches are available.
Original NVD description (English source)
A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.