Description
A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Trane Technologies | XL824 Thermostat | ≤ 5.9.8 | — |
| Trane Technologies | XL850 Thermostat | ≤ 5.9.8 | — |
| Trane Technologies | XL1050 Thermostat | ≤ 5.9.8 | — |
| Trane Technologies | Pivot Thermostat | ≤ 1.8 | — |
Advisories 1
- ICSA-23-234-02 Trane Thermostats CISA ICS & IT advisories · Aug 22, 2023