CVE-2023-4212: Trane Pivot Firmware

Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days.

​A command injection vulnerability exists in Trane XL824, XL850, XL1050, and Pivot thermostats allowing an attacker to execute arbitrary commands as root using a specially crafted filename. The vulnerability requires physical access to the device via a USB stick.

Affected products

• Trane Pivot Firmware: up to and including 1.8
• Trane XL1050 Firmware: up to and including 5.9.8
• Trane XL824 Firmware: up to and including 5.9.8
• Trane XL850 Firmware: up to and including 5.9.8

Published 2023-08-22. Last modified 2026-06-17.