Security Advisory

CVE-2023-4212

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2023-08-22 17:34:12

Last updated 2025-01-16 21:30:56

Assigner icscert

CVSS score 6.8

State PUBLISHED

Description

A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.

← Browse all CVEs View on cve.org ↗