CVE-2023-4212 (pivot_firmware, xl1050_firmware, xl824_firmware, xl850_firmware)

?A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.

access command command injection cve device filename injection physical pivot root trane usb usb stick vulnerability