Description
A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.
Metrics
CVSS 3.1 6.8/10
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| Trane Technologies | XL824 Thermostat | <= 5.9.8 |
| Trane Technologies | XL850 Thermostat | <= 5.9.8 |
| Trane Technologies | XL1050 Thermostat | <= 5.9.8 |
| Trane Technologies | Pivot Thermostat | <= 1.8 |
References
- https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-234-02Broken Link
- https://hub.tranetechnologies.com/docs/DOC-216377Permissions Required
- https://www.trane.com/commercial/north-america/us/en/contact-us/locate-sales-offices.htmlProduct
- https://www.cisa.gov/news-events/ics-advisories/icsa-23-234-02Third Party Advisory
- https://https://www.cisa.gov/news-events/ics-advisories/icsa-23-234-02Broken Link
- https://hub.tranetechnologies.com/docs/DOC-216377Permissions Required
- https://www.trane.com/commercial/north-america/us/en/contact-us/locate-sales-offices.htmlProduct
Timeline
- Published
- Aug 22, 2023
- Last modified
- Jun 17, 2026
- NVD status
- Modified