Skip to content
OpenAdvisories

Vendor

Trane

10 known vulnerabilities.

Trane at a glance

Last 12 months
5
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 5 vulnerabilities, 1 critical Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202651
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Tracer SC 7 Tracer Concierge 6 ComfortLink II SCC firmware 2 Symbio 1 Technologies XL824 Thermostat 0 Technologies XL850 Thermostat 0 Technologies XL1050 Thermostat 0 Technologies Pivot Thermostat 0 Odyssey Split Systems 0 Ascend Air-Cooled Chiller Model ACR 0 Agility Water-Cooled Chiller Model HDWA 0 IntelliPak Rooftop Air Conditioner 0

Latest advisories

  • High max 9.2
    ICSA-26-071-01 5 CVEs

    Trane Tracer SC, Tracer SC+, and Tracer Concierge

    Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, execute arbitrary commands, or perform a denial-of-service on the product.

    Trane
  • Medium
    ICSA-16-259-03 1 CVE rev. 2

    Trane Tracer SC Sensitive Information Exposure Vulnerability

    Trane
    first Jun 19, 2016
  • Medium max 6.8
    ICSA-23-234-02 1 CVE

    Trane Thermostats

    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands as root using a specially crafted filename.

    Trane
  • High max 7.5
    ICSA-21-266-01 1 CVE rev. 3

    Trane Symbio (Update B)

    Successful exploitation of this vulnerability could allow a user to execute arbitrary code on the controller.

    Trane
    first Sep 23, 2021
  • Medium max 6.3
    ICSA-21-292-02 1 CVE

    Trane HVAC Systems Controls

    Successful exploitation of this vulnerability could allow an attacker to redirect a user to a malicious webpage and steal the user 's cookie.

    Trane
All Critical High Medium Low Exploited only Public exploit

10 results · Feed

  • Medium 6.9
    CVE-2026-28256

    Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

    Trane Tracer SC Tracer Concierge
  • High 8.2
    CVE-2026-28255

    Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

    Trane Tracer SC Tracer Concierge
  • Medium 6.9
    CVE-2026-28254

    Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotected APIs.

    Trane Tracer SC Tracer Concierge
  • High 8.7
    CVE-2026-28253

    Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition

    Trane Tracer SC Tracer Concierge
  • Critical 9.2
    CVE-2026-28252

    Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

    A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.

    Trane Tracer SC Tracer Concierge
  • High 7.5
    CVE-2021-38448

    Trane Symbio Improper Control of Generation of Code

    The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

    Trane Symbio
  • Critical 9.9
    CVE-2021-38450

    Trane Tracer Code Injection

    The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

    Trane Tracer SC Tracer Concierge
  • Medium 6.3
    CVE-2021-42534

    Trane Building Automation Controllers Cross-site Scripting

    The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.

    Trane Tracer SC
  • Unscored —
    CVE-2015-2867

    A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 service allows remote attackers to take complete c…

    Trane ComfortLink II SCC firmware
  • Unscored —
    CVE-2015-2868

    An exploitable remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in DSS ser…

    Trane ComfortLink II SCC firmware