Trane HVAC Systems Controls
Successful exploitation of this vulnerability could allow an attacker to redirect a user to a malicious webpage and steal the user 's cookie.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-42534US | medium6.1 | — | ||
The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms. | ||||
references
External citations — patches, advisories, analysis.
remediations (2)
- MitigationTracer SC
Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).
- FixedTracer SC
Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends users identify a migration plan to replace the Tracer SC controller with the Tracer SC+ controller, which can function as a drop-in replacement for Tracer SC, providing significant security upgrades.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan