Critical · 9.2 CVE-2026-28252 EUVD-2026-11629GHSA-mvqv-5q67-w9vh

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

Published Mar 12, 2026 · Updated Mar 13, 2026 · Assigned by icscert

Vendor: Trane Product: Tracer Concierge Product: Tracer SC

Description

A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.

Affected products

Vendor	Product	Affected	Fixed
Trane	Tracer SC	< v4.4 SP7	v4.4 SP7
Trane	Tracer SC+	< v6.3.2310	v6.3.2310
Trane	Tracer Concierge	< v6.3.2310	v6.3.2310

Advisories 1

ICSA-26-071-01 Trane Tracer SC, Tracer SC+, and Tracer Concierge CISA ICS & IT advisories · Mar 12, 2026

References

https://www.cisa.gov/news-events/ics-advisories/icsa-26-071-01 government-resource