Skip to content
OpenAdvisories
High ICSA-26-071-01 5 CVEs

Trane Tracer SC, Tracer SC+, and Tracer Concierge

Published Mar 12, 2026 · Updated Mar 12, 2026

Vendor: Trane Product: Tracer Concierge Product: Tracer SC

Summary

Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, execute arbitrary commands, or perform a denial-of-service on the product.

Vulnerabilities 5

  • Critical 9.2
    CVE-2026-28252

    Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.

    Trane Tracer SC Tracer Concierge
  • High 8.7
    CVE-2026-28253

    Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition

    Trane Tracer SC Tracer Concierge
  • High 8.2
    CVE-2026-28255

    Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

    Trane Tracer SC Tracer Concierge
  • Medium 6.9
    CVE-2026-28254

    Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.

    Trane Tracer SC Tracer Concierge
  • Medium 6.9
    CVE-2026-28256

    Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

    Trane Tracer SC Tracer Concierge

Revision history

  1. #1

    Initial Publication

References