All CISA Advisories, EN

Trane Tracer SC, Tracer SC+, and Tracer Concierge

View CSAF

Summary

Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, execute arbitrary commands, or perform a denial-of-service on the product.

The following versions of Trane Tracer SC, Tracer SC+, and Tracer Concierge are affected:

  • Tracer SC
  • Tracer SC+
  • Tracer Concierge
CVSS Vendor Equipment Vulnerabilities
v3 8.1 Trane Trane Tracer SC, Tracer SC+, and Tracer Concierge Use of a Broken or Risky Cryptographic Algorithm, Memory Allocation with Excessive Size Value, Missing Authorization, Use of Hard-coded Credentials, Use of Hard-coded, Security-relevant Constants

Background

  • Critical Infrastructure Sectors: Critical Manufacturing
  • Countries/Areas Deployed: Worldwide
  • Company Headquarters Location: Ireland

Vulnerabilities

Expand All +

CVE-2026-28252

A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.

View CVE Details

Affected Products

Trane Tracer SC, Tracer SC+, and Tracer Concierge
Vendor:
Trane
Product Version:
Trane Tracer SC: <v4.4_SP7, Trane Tracer SC+: <v6.3.2310, Trane Tracer Concierge: <v6.3.2310
Product Status:
known_affected
Remediations

Vendor fix
Trane has released the following versions of Tracer SC+ for users to upgrade to:

Vendor fix
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313

Relevant CWE: CWE-327 Use of a Broken or Risky Cryptographic Algorithm

Metrics

CVSS Version Base Score Base Severity Vector String
3.0 8.1 HIGH CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE-2026-28253

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition.

View CVE Details

Affected Products

Trane Tracer SC, Tracer SC+, and Tracer Concierge
Vendor:
Trane
Product Version:
Trane Tracer SC: <v4.4_SP7, Trane Tracer SC+: <v6.3.2310, Trane Tracer Concierge: <v6.3.2310
Product Status:
known_affected
Remediations

Vendor fix
Trane has released the following versions of Tracer SC+ for users to upgrade to:

Vendor fix
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313

Relevant CWE: CWE-789 Memory Allocation with Excessive Size Value

Metrics

CVSS Version Base Score Base Severity Vector String
3.0 7.5 HIGH This article has been indexed from All CISA Advisories

Read the original article: