ICSA-21-266-02

icsaUScisa_csaf_ot

Trane Tracer

Advisory ansehen veröffentlicht 2021-09-23

Successful exploitation of this vulnerability could allow an authenticated user to execute arbitrary code on the controller.

01

beschreibt (1)

Zugehörige CVEs.

IDSchweregrad ausnutzbar
CVE-2021-38450UShigh8.8—
The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.
02

Referenzen

Externe Belege — Patches, Meldungen, Analysen.

03

Behebungen (6)

  • MitigationTracer Concierge

    Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).

  • MitigationTracer SC

    Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).

  • MitigationTracer SC+

    Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).

  • BehobenTracer Concierge

    Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.

  • BehobenTracer SC

    Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.

  • BehobenTracer SC+

    Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.

scry

Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan