CVE-2023-4212

Published Aug 22, 2023

Last updated a year ago

Overview

Description
​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.
Source
ics-cert@hq.dhs.gov
NVD status
Modified

Risk scores

CVSS 3.1

Type
Primary
Base score
6.8
Impact score
5.9
Exploitability score
0.9
Vector string
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
MEDIUM

Weaknesses

nvd@nist.gov
CWE-77
ics-cert@hq.dhs.gov
CWE-74

Social media

Hype score
Not currently trending

Configurations