Trane Tracer SC, Tracer SC+, and Tracer Concierge
Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, execute arbitrary commands, or perform a denial-of-service on the product.
describes (5)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-28256US | critical9.8 | — | ||
A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and ta… | ||||
| CVE-2026-28255US | critical9.8OT elevated | — | ||
A Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts. | ||||
| CVE-2026-28254US | high7.5OT elevated | — | ||
A Missing Authorization vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to access sensitive information through unprotect… | ||||
| CVE-2026-28253US | high7.5 | — | ||
A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-servic… | ||||
| CVE-2026-28252US | critical9.8OT elevated | — | ||
A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-26-071-01 JSONself
- ICSA Advisory ICSA-26-071-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (21)
- MitigationTracer Concierge
CVE-2026-28255: Trane has implemented enhanced cloud security controls to mitigate this vulnerability.
- MitigationTracer Concierge
CVE-2026-28256: Trane has implemented enhanced security controls which have been communicated to their customers. For more information, contact Trane.
- MitigationTracer SC
CVE-2026-28255: Trane has implemented enhanced cloud security controls to mitigate this vulnerability.
- MitigationTracer SC
CVE-2026-28256: Trane has implemented enhanced security controls which have been communicated to their customers. For more information, contact Trane.
- MitigationTracer SC+
CVE-2026-28255: Trane has implemented enhanced cloud security controls to mitigate this vulnerability.
- MitigationTracer SC+
CVE-2026-28256: Trane has implemented enhanced security controls which have been communicated to their customers. For more information, contact Trane.
- FixedTracer Concierge
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313
- FixedTracer Concierge
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313
- FixedTracer Concierge
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313
- FixedTracer Concierge
Trane has released the following versions of Tracer SC+ for users to upgrade to:
- FixedTracer Concierge
Trane has released the following versions of Tracer SC+ for users to upgrade to:
- FixedTracer SC
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313
- FixedTracer SC
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313
- FixedTracer SC
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313
- FixedTracer SC
Trane has released the following versions of Tracer SC+ for users to upgrade to:
- FixedTracer SC
Trane has released the following versions of Tracer SC+ for users to upgrade to:
- FixedTracer SC+
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313
- FixedTracer SC+
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313
- FixedTracer SC+
CVE-2026-28252, CVE-2026-28253, CVE-2026-28254: Tracer SC+ version v6.30.2313
- FixedTracer SC+
Trane has released the following versions of Tracer SC+ for users to upgrade to:
- FixedTracer SC+
Trane has released the following versions of Tracer SC+ for users to upgrade to:
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan