CVE-2023-4212

CVSS V2 None CVSS V3 None

Description

A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.

Overview

CVE ID
CVE-2023-4212

Assigner
icscert

Vulnerability Status
PUBLISHED

Published Version
2023-08-22T17:34:12.059Z

Last Modified Date
2023-08-22T17:34:12.059Z

Weakness Enumerations

CWE	URL
CWE-74	http://cwe.mitre.org/data/definitions/74.html

References

Reference URL	Reference Tags
https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-234-02
https://hub.tranetechnologies.com/docs/DOC-216377
https://www.trane.com/commercial/north-america/us/en/contact-us/locate-sales-offices.html

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2023-4212
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-4212

History

Created	Old Value	New Value	Data Type	Notes
2024-06-24 19:39:13				Added to TrackCVE