CVE-2021-38450

mediumPriorität · verfolgen · 35EPSS 0.010 · 64. PerzentilEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.05% (64th) EPSS
CVSS 6.5 · medium
Is it mine?
15 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · cisa_csaf_ot · nvd

EPSS · bewertet 2026-10-27

The affected controllers do not properly sanitize the input containing code syntax. As a result, an attacker could craft code to alter the intended controller flow of the software.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenTracer Conciergecisa_csaf_ot

    Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.

  • BehobenTracer SCcisa_csaf_ot

    Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.

  • BehobenTracer SC+cisa_csaf_ot

    Tracer SC is no longer actively developed, tested, or sold. Tracer SC will be considered end-of-life on December 31, 2022. Trane recommends identifying a migration plan for replacing the Tracer SC controller with the next-generation Tracer SC+ controller. Tracer SC+ can function as a drop-in replacement for Tracer SC, providing significant updates to security capabilities.

  • MitigationTracer Conciergecisa_csaf_ot

    Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).

  • MitigationTracer SCcisa_csaf_ot

    Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).

  • MitigationTracer SC+cisa_csaf_ot

    Ensure user credentials are not shared and follow best practices for appropriate complexity (e.g., strong passwords).

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.9
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.5–9.9

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 8 · Auswirkung 6.4
v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9
v3.09.9criticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:Hsecondary · CISA US
v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:Hsecondary · ENISA EU
v3.19.9criticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:Hsecondary · ics-cert@hq.dhs.gov USAusnutzbarkeit 3.1 · Auswirkung 6
v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-94USCWE-94US
04

betroffene Produkte (15)

Betroffene Produkte und Versionsbereiche.

05

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-21-266-02Trane Tracer2021-09-23icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability could allow an authenticated user to execute arbitrary code on the controller.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otnvdNVDCVE.orgMITRE
veröffentlicht 2021-10-27geändert 2026-06-17
08

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan