Read the docs

Trane

Records13All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical4CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9

Exploited now

Trane records in CISA KEV

No Trane vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Tracer Sc Firmware 7 records MEDIUM Tracer Concierge 6 records MEDIUM Tracer Sc+ Firmware 6 records MEDIUM Comfortlink Ii Firmware 2 records MEDIUM Tracer Sc 2 records LOW Pivot Firmware 1 record LOW Symbio 700 1 record LOW Symbio 800 1 record LOW

Records

7 records in Tracer Sc Firmware · all components

TI-2021-16050 CVE-2021-38450 · GHSA-m3xr-5f4w-px4w

Trane Tracer Code Injection

Priority MEDIUM 45

The affected controllers do not properly sanitize the input containing code syntax.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01049 Published 2021-10-27 Fixed in 4.4 SP7, 5.5 SP3 CWE-94
TI-2026-22569 CVE-2026-28253 · GHSA-c7pr-383r-xgg3

Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

Priority MEDIUM 44

A Memory Allocation with Excessive Size Value vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an unauthenticated attacker to cause a denial-of-service condition

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00352 Published 2026-03-12 Fixed in v4.4 SP7, v6.3.2310 CWE-789
TI-2026-22568 CVE-2026-28252 · GHSA-mvqv-5q67-w9vh

Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

Priority MEDIUM 41

A Use of a Broken or Risky Cryptographic Algorithm vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to bypass authentication and gain root-level access to the device.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00248 Published 2026-03-12 Fixed in v4.4 SP7, v6.3.2310 CWE-327
TI-2026-22572 CVE-2026-28256 · GHSA-7fm4-cpxv-5vqw

Use of Hard-coded Credentials vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge

Priority LOW 30

A Use of Hard-coded, Security-relevant Constants vulnerability in Trane Tracer SC, Tracer SC+, and Tracer Concierge could allow an attacker to disclose sensitive information and take over accounts.

CVSS 4.0MEDIUM 6.9 Network High privileges No interaction EPSS 0.00305 Published 2026-03-12 Fixed in v4.4 SP7, v6.3.2310 CWE-547
TI-2021-18820 CVE-2021-42534 · GHSA-mx7v-jfp8-4wr2

Trane Building Automation Controllers Cross-site Scripting

Priority LOW 29

The affected product’s web application does not properly neutralize the input during webpage generation, which could allow an attacker to inject code in the input forms.

CVSS 3.1MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00607 Published 2021-10-22 No fix listed CWE-79
Open these records in search →