ICSA-21-266-02

icsaUScisa_csaf_ot

Trane Tracer

view advisory published 2021-09-23

Successful exploitation of this vulnerability could allow an authenticated user to execute arbitrary code on the controller.

01

describes (1)

Related CVEs.

IDseverity exploitable
CVE-2021-38450UShigh8.8—
The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.
02

references

External citations — patches, advisories, analysis.

03

remediations (6)

  • MitigationTracer Concierge

    Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).

  • MitigationTracer SC

    Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).

  • MitigationTracer SC+

    Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).

  • FixedTracer Concierge

    Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.

  • FixedTracer SC

    Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.

  • FixedTracer SC+

    Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan